main.bicep

targetScope = 'subscription'

@minLength(1)
@maxLength(64)
@description('Name of the the environment which is used to generate a short unique hash used in all resources.')
param environmentName string

@minLength(1)
@description('Location for AI Search and Storage resources')
// Constrained due to semantic ranker availability: https://learn.microsoft.com/azure/search/search-region-support#americas
@allowed([
  'brazilsouth'
  'canadacentral'
  'canadaeast'
  'eastus2'
  'northcentralus'
  'westus'
  'westus2'
  'westcentralus'
  'northeurope'
  'francecentral'
  'switzerlandnorth'
  'switzerlandwest'
  'uksouth'
  'australiaeast'
  'eastasia'
  'southeastasia'
  'centralindia'
  'jioindiawest'
  'japanwest'
  'koreacentral'
])
@metadata({
  azd: {
    type: 'location'
  }
})
param location string

param backendServiceName string = ''
param resourceGroupName string = ''

param logAnalyticsName string = ''

param reuseExistingSearch bool
param searchEndpoint string = ''
param searchServiceName string = ''
param searchServiceResourceGroupName string = ''
param searchServiceLocation string = ''
// The free tier does not support managed identity (required) or semantic search (optional)
@allowed(['free', 'basic', 'standard', 'standard2', 'standard3', 'storage_optimized_l1', 'storage_optimized_l2'])
param searchServiceSkuName string
param searchIndexName string
param searchServiceReplicaCount int = 1
param searchSemanticConfiguration string
param searchServiceSemanticRankerLevel string = 'disabled'
var actualSearchServiceSemanticRankerLevel = (searchServiceSkuName == 'free')
  ? 'disabled'
  : searchServiceSemanticRankerLevel
param searchChunkField string
param searchMetadataField string
param searchDocIdField string
param searchIdField string
param searchEmbeddingField string
param searchEmbeddingDimensionality int
param searchUseVectorQuery bool

param storageAccountName string = ''
param storageResourceGroupName string = ''
param storageResourceGroupLocation string = location
param storageContainerName string = 'content'
param storageSkuName string = 'Standard_LRS'

param reuseExistingOpenAi bool = false
param openAiServiceName string = ''
param openAiResourceGroupName string = ''
param openAiEndpoint string = ''
param openAiChatDeployment string = 'gpt-4o-mini'
param openAiChatModel string = 'gpt-4o-mini'
param openAiChatDeploymentVersion string = '2024-07-18'
param openAiEmbedModel string = 'text-embedding-ada-002'
param openAiEmbedModelVersion string = '2'
param openAiChatVoiceChoice string = 'alloy'
param openAiChatSkuName string = 'Standard'
param openAiEmbedSkuName string = 'Standard'
param chatDeploymentCapacity int = 30
param openAiEmbeddingDeploymentCapacity int = 30

// leave this empty will disable file URLs generated (in the UI)
param llamaIndexFileserverUrlPrefix string = ''
param llamaIndexCacheDir string = '.cache'
param llamaIndexSystemPrompt string = '''
you are an assistant. Always use data_query_engine to answer the user\'s questions, and query for documents from your data source
'''

@description('Location for the OpenAI resource group')
@allowed([
  'eastus2'
  'swedencentral'
])
@metadata({
  azd: {
    type: 'location'
  }
})
param openAiServiceLocation string
param openAiApiVersion string = '2024-02-15-preview'

param tenantId string = tenant().tenantId

@description('Id of the user or app to assign application roles')
param principalId string = ''

var abbrs = loadJsonContent('abbreviations.json')
var resourceToken = toLower(uniqueString(subscription().id, environmentName, location))
var tags = { 'azd-env-name': environmentName }

@description('Whether the deployment is running on GitHub Actions')
param runningOnGh string = ''

@description('Whether the deployment is running on Azure DevOps Pipeline')
param runningOnAdo string = ''

@description('Used by azd for containerapps deployment')
param webAppExists bool

@allowed(['Consumption', 'D4', 'D8', 'D16', 'D32', 'E4', 'E8', 'E16', 'E32', 'NC24-A100', 'NC48-A100', 'NC96-A100'])
param azureContainerAppsWorkloadProfile string

param acaIdentityName string = '${environmentName}-aca-identity'
param containerRegistryName string = '${replace(environmentName, '-', '')}acr'

// Figure out if we're running as a user or service principal
var principalType = empty(runningOnGh) && empty(runningOnAdo) ? 'User' : 'ServicePrincipal'

// Organize resources in a resource group
resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
  name: !empty(resourceGroupName) ? resourceGroupName : '${abbrs.resourcesResourceGroups}${environmentName}'
  location: location
  tags: tags
}

resource openAiResourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' existing = if (!empty(openAiResourceGroupName)) {
  name: !empty(openAiResourceGroupName) ? openAiResourceGroupName : resourceGroup.name
}

resource searchServiceResourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' existing = if (!empty(searchServiceResourceGroupName)) {
  name: !empty(searchServiceResourceGroupName) ? searchServiceResourceGroupName : resourceGroup.name
}

resource storageResourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' existing = if (!empty(storageResourceGroupName)) {
  name: !empty(storageResourceGroupName) ? storageResourceGroupName : resourceGroup.name
}

module logAnalytics 'br/public:avm/res/operational-insights/workspace:0.7.0' = {
  name: 'loganalytics'
  scope: resourceGroup
  params: {
    name: !empty(logAnalyticsName) ? logAnalyticsName : '${abbrs.operationalInsightsWorkspaces}${resourceToken}'
    location: location
    tags: tags
    skuName: 'PerGB2018'
    dataRetention: 30
    publicNetworkAccessForIngestion: 'Enabled'
    publicNetworkAccessForQuery: 'Enabled'
    useResourcePermissions: true
  }
}

// Azure container apps resources

// User-assigned identity for pulling images from ACR
module acaIdentity 'core/security/aca-identity.bicep' = {
  name: 'aca-identity'
  scope: resourceGroup
  params: {
    identityName: acaIdentityName
    location: location
  }
}

module containerApps 'core/host/container-apps.bicep' = {
  name: 'container-apps'
  scope: resourceGroup
  params: {
    name: 'app'
    tags: tags
    location: location
    workloadProfile: azureContainerAppsWorkloadProfile
    containerAppsEnvironmentName: '${environmentName}-aca-env'
    containerRegistryName: '${containerRegistryName}${resourceToken}'
    logAnalyticsWorkspaceResourceId: logAnalytics.outputs.resourceId
  }
}

// Container Apps for the web application
module acaBackend 'core/host/container-app-upsert.bicep' = {
  name: 'aca-web'
  scope: resourceGroup
  dependsOn: [
    containerApps
    acaIdentity
  ]
  params: {
    name: !empty(backendServiceName) ? backendServiceName : '${abbrs.webSitesContainerApps}backend-${resourceToken}'
    location: location
    identityName: acaIdentityName
    exists: webAppExists
    workloadProfile: azureContainerAppsWorkloadProfile
    containerRegistryName: containerApps.outputs.registryName
    containerAppsEnvironmentName: containerApps.outputs.environmentName
    identityType: 'UserAssigned'
    tags: union(tags, { 'azd-service-name': 'llamaindex' })
    targetPort: 3000
    containerCpuCoreCount: '1.0'
    containerMemory: '2Gi'
    env: {
      AZURE_AI_SEARCH_ENDPOINT: reuseExistingSearch
        ? searchEndpoint
        : 'https://${searchService.outputs.name}.search.windows.net'
      AZURE_AI_SEARCH_INDEX: searchIndexName
      AZURE_AI_SEARCH_SEMANTIC_CONFIGURATION: searchSemanticConfiguration
      AZURE_AI_SEARCH_CHUNK_FIELD: searchChunkField
      AZURE_AI_SEARCH_METADATA_FIELD: searchMetadataField
      AZURE_AI_SEARCH_DOC_ID_FIELD: searchDocIdField
      AZURE_AI_SEARCH_EMBEDDING_FIELD: searchEmbeddingField
      AZURE_AI_SEARCH_EMBEDDING_DIMENSIONALITY: searchEmbeddingDimensionality
      AZURE_AI_SEARCH_USE_VECTOR_QUERY: searchUseVectorQuery
      AZURE_OPENAI_ENDPOINT: reuseExistingOpenAi ? openAiEndpoint : openAi.outputs.endpoint
      AZURE_OPENAI_CHAT_DEPLOYMENT: reuseExistingOpenAi ? openAiChatDeployment : openAiDeployments[0].name
      AZURE_OPENAI_CHAT_VOICE_CHOICE: openAiChatVoiceChoice
      // must be named exactly like this for the openai-node sdk to pick it up
      OPENAI_API_VERSION: openAiApiVersion
      // CORS support, for frontends on other hosts
      RUNNING_IN_PRODUCTION: 'true'
      // For using managed identity to access Azure resources. See https://github.com/microsoft/azure-container-apps/issues/442
      AZURE_CLIENT_ID: acaIdentity.outputs.clientId

      // LlamaIndex configurations
      // Location of the cache directory for the LlamaIndex to store embeddings and index data
      LLAMAINDEX_STORAGE_CACHE_DIR: llamaIndexCacheDir
      LLAMAINDEX_FILESERVER_URL_PREFIX: llamaIndexFileserverUrlPrefix
      LLAMAINDEX_SYSTEM_PROMPT: llamaIndexSystemPrompt
      DEBUG: 'true'
    }
  }
}

var openAiDeployments = [
  {
    name: openAiChatModel
    model: {
      format: 'OpenAI'
      name: openAiChatModel
      version: openAiChatDeploymentVersion
    }
    sku: {
      name: openAiChatSkuName
      capacity: chatDeploymentCapacity
    }
  }
  {
    name: openAiEmbedModel
    model: {
      format: 'OpenAI'
      name: openAiEmbedModel
      version: openAiEmbedModelVersion
    }
    sku: {
      name: openAiEmbedSkuName
      capacity: openAiEmbeddingDeploymentCapacity
    }
  }
]

module openAi 'br/public:avm/res/cognitive-services/account:0.8.0' = if (!reuseExistingOpenAi) {
  name: 'openai'
  scope: openAiResourceGroup
  params: {
    name: !empty(openAiServiceName) ? openAiServiceName : '${abbrs.cognitiveServicesAccounts}${resourceToken}'
    location: openAiServiceLocation
    tags: tags
    kind: 'OpenAI'
    customSubDomainName: !empty(openAiServiceName)
      ? openAiServiceName
      : '${abbrs.cognitiveServicesAccounts}${resourceToken}'
    sku: 'S0'
    deployments: openAiDeployments
    disableLocalAuth: false
    restrictOutboundNetworkAccess: false
    publicNetworkAccess: 'Enabled'
    networkAcls: {
      defaultAction: 'Allow'
    }
    roleAssignments: [
      {
        roleDefinitionIdOrName: 'Cognitive Services OpenAI User'
        principalId: principalId
        principalType: principalType
      }
    ]
  }
}

module searchService 'br/public:avm/res/search/search-service:0.7.1' = if (!reuseExistingSearch) {
  name: 'search-service'
  scope: searchServiceResourceGroup
  params: {
    name: !empty(searchServiceName) ? searchServiceName : 'gptkb-${resourceToken}'
    location: !empty(searchServiceLocation) ? searchServiceLocation : location
    tags: tags
    disableLocalAuth: true
    sku: searchServiceSkuName
    replicaCount: searchServiceReplicaCount
    semanticSearch: actualSearchServiceSemanticRankerLevel
    // An outbound managed identity is required for integrated vectorization to work,
    // and is only supported on non-free tiers:
    managedIdentities: { systemAssigned: true }
    roleAssignments: [
      {
        roleDefinitionIdOrName: 'Search Index Data Reader'
        principalId: principalId
        principalType: principalType
      }
      {
        roleDefinitionIdOrName: 'Search Index Data Contributor'
        principalId: principalId
        principalType: principalType
      }
      {
        roleDefinitionIdOrName: 'Search Service Contributor'
        principalId: principalId
        principalType: principalType
      }
    ]
  }
}

module storage 'br/public:avm/res/storage/storage-account:0.9.1' = {
  name: 'storage'
  scope: storageResourceGroup
  params: {
    name: !empty(storageAccountName) ? storageAccountName : '${abbrs.storageStorageAccounts}${resourceToken}'
    location: storageResourceGroupLocation
    tags: tags
    kind: 'StorageV2'
    skuName: storageSkuName
    publicNetworkAccess: 'Enabled' // Necessary for uploading documents to storage container
    networkAcls: {
      defaultAction: 'Allow'
      bypass: 'AzureServices'
    }
    allowBlobPublicAccess: false
    allowSharedKeyAccess: false
    blobServices: {
      deleteRetentionPolicyDays: 2
      deleteRetentionPolicyEnabled: true
      containers: [
        {
          name: storageContainerName
          publicAccess: 'None'
        }
      ]
    }
    roleAssignments: [
      {
        roleDefinitionIdOrName: 'Storage Blob Data Reader'
        principalId: principalId
        principalType: principalType
      }
      // For uploading documents to storage container:
      {
        roleDefinitionIdOrName: 'Storage Blob Data Contributor'
        principalId: principalId
        principalType: principalType
      }
    ]
  }
}

// Roles for the backend to access other services
module openAiRoleBackend 'core/security/role.bicep' = {
  scope: openAiResourceGroup
  name: 'openai-role-backend'
  params: {
    principalId: acaBackend.outputs.identityPrincipalId
    roleDefinitionId: '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd'
    principalType: 'ServicePrincipal'
  }
}

// Used to issue search queries
// https://learn.microsoft.com/azure/search/search-security-rbac
module searchRoleBackend 'core/security/role.bicep' = {
  scope: searchServiceResourceGroup
  name: 'search-role-backend'
  params: {
    principalId: acaBackend.outputs.identityPrincipalId
    roleDefinitionId: '1407120a-92aa-4202-b7e9-c0e197c71c8f'
    principalType: 'ServicePrincipal'
  }
}

// Necessary for integrated vectorization, for search service to access storage
module storageRoleSearchService 'core/security/role.bicep' = if (!reuseExistingSearch) {
  scope: storageResourceGroup
  name: 'storage-role-searchservice'
  params: {
    principalId: !reuseExistingSearch ? searchService.outputs.systemAssignedMIPrincipalId : ''
    roleDefinitionId: '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1' // Storage Blob Data Reader
    principalType: 'ServicePrincipal'
  }
}

// Necessary for integrated vectorization, for search service to access OpenAI embeddings
module openAiRoleSearchService 'core/security/role.bicep' = if (!reuseExistingSearch) {
  scope: openAiResourceGroup
  name: 'openai-role-searchservice'
  params: {
    principalId: !reuseExistingSearch ? searchService.outputs.systemAssignedMIPrincipalId : ''
    roleDefinitionId: '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd'
    principalType: 'ServicePrincipal'
  }
}

// /!\ Do not output AZURE_CLIENT_ID for local development!
// If detected, it will be used to authenticate the user 
// using a user-assigned managed identity on Azure.
// However, this is not supported in local development.
output AZURE_CLIENT_ID string = acaIdentity.outputs.clientId

output AZURE_LOCATION string = location
output AZURE_TENANT_ID string = tenantId
output AZURE_RESOURCE_GROUP string = resourceGroup.name

// must be named exactly like this for the openai-node sdk to pick it up
output OPENAI_API_VERSION string = openAiApiVersion
output AZURE_OPENAI_ENDPOINT string = reuseExistingOpenAi ? openAiEndpoint : openAi.outputs.endpoint
output AZURE_OPENAI_CHAT_DEPLOYMENT string = reuseExistingOpenAi
  ? openAiChatDeployment
  : openAiDeployments[0].name
output AZURE_OPENAI_CHAT_VOICE_CHOICE string = openAiChatVoiceChoice
output AZURE_OPENAI_EMBEDDING_DEPLOYMENT string = openAiEmbedModel
output AZURE_OPENAI_EMBEDDING_MODEL string = openAiEmbedModel
output AZURE_OPENAI_CHATGPT_MODEL string = openAiChatModel

output AZURE_AI_SEARCH_ENDPOINT string = reuseExistingSearch
  ? searchEndpoint
  : 'https://${searchService.outputs.name}.search.windows.net'
output AZURE_AI_SEARCH_INDEX string = searchIndexName
output AZURE_AI_SEARCH_SEMANTIC_CONFIGURATION string = searchSemanticConfiguration
output AZURE_AI_SEARCH_CHUNK_FIELD string = searchChunkField
output AZURE_AI_SEARCH_METADATA_FIELD string = searchMetadataField
output AZURE_AI_SEARCH_ID_FIELD string = searchIdField
output AZURE_AI_SEARCH_DOC_ID_FIELD string = searchDocIdField
output AZURE_AI_SEARCH_EMBEDDING_FIELD string = searchEmbeddingField
output AZURE_AI_SEARCH_EMBEDDING_DIMENSIONALITY int = searchEmbeddingDimensionality
output AZURE_AI_SEARCH_USE_VECTOR_QUERY bool = searchUseVectorQuery

output AZURE_STORAGE_ENDPOINT string = storage.outputs.primaryBlobEndpoint
output AZURE_STORAGE_ACCOUNT string = storage.outputs.name
output AZURE_STORAGE_CONNECTION_STRING string = 'ResourceId=/subscriptions/${subscription().subscriptionId}/resourceGroups/${storageResourceGroup.name}/providers/Microsoft.Storage/storageAccounts/${storage.outputs.name}'
output AZURE_STORAGE_CONTAINER string = storageContainerName
output AZURE_STORAGE_RESOURCE_GROUP string = storageResourceGroup.name

output BACKEND_URI string = acaBackend.outputs.uri
output AZURE_CONTAINER_REGISTRY_ENDPOINT string = containerApps.outputs.registryLoginServer

output LLAMAINDEX_STORAGE_CACHE_DIR string = llamaIndexCacheDir
output LLAMAINDEX_SYSTEM_PROMPT string = llamaIndexSystemPrompt
output LLAMAINDEX_FILESERVER_URL_PREFIX string = llamaIndexFileserverUrlPrefix