{
  "$id": "https://firefox-ci-tc.services.mozilla.com/schemas/worker-manager/v1/azure-arm-templates.json#",
  "$schema": "https://firefox-ci-tc.services.mozilla.com/schemas/common/metaschema.json#",
  "additionalProperties": true,
  "description": "ARM Template deployment configuration for Azure VMs.\nThese properties are passed directly to the Azure Deployments API.\nNote: workerManager and workerConfig are defined in the parent schema.\n\n[Template Syntax](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/syntax)\n\nARM Deployments allows full provisioning of many related resources at once, offloading the provisioning process to Azure Resource Manager.\n",
  "properties": {
    "armDeployment": {
      "additionalProperties": false,
      "description": "Azure Resource Manager deployment configuration.\nThese properties are passed directly to the Azure Deployments API.\n\nSECURITY RECOMMENDATION: Use templateLink with id (template specs) for production deployments.\nAvoid templateLink with uri unless using trusted, controlled sources.\n\nYou must specify exactly ONE of: template (inline) or templateLink (external/template spec).\n",
      "oneOf": [
        {
          "required": [
            "template"
          ]
        },
        {
          "required": [
            "templateLink"
          ]
        }
      ],
      "properties": {
        "debugSetting": {
          "additionalProperties": false,
          "description": "Debug setting for deployment",
          "properties": {
            "detailLevel": {
              "description": "Specifies the type of information to log for debugging.\n",
              "enum": [
                "requestContent",
                "responseContent",
                "requestContent,responseContent"
              ],
              "type": "string"
            }
          },
          "title": "Debug Settings",
          "type": "object"
        },
        "expressionEvaluationOptions": {
          "additionalProperties": false,
          "description": "Options to control template expression evaluation",
          "properties": {
            "scope": {
              "description": "The scope for template expression evaluation.\n- Inner: Expressions are evaluated within the scope of nested templates\n- Outer: Expressions are evaluated in the parent template scope\n",
              "enum": [
                "Inner",
                "Outer"
              ],
              "type": "string"
            }
          },
          "title": "Expression Evaluation Options",
          "type": "object"
        },
        "mode": {
          "description": "The deployment mode.\n- Incremental: Deploy resources without deleting existing resources not in the template\n- Complete: (USE WITH CAUTION) Deploy resources and delete existing resources not in the template\n",
          "enum": [
            "Incremental",
            "Complete"
          ],
          "type": "string"
        },
        "onErrorDeployment": {
          "additionalProperties": false,
          "description": "The deployment on error behavior. Rollback on failure.\n",
          "properties": {
            "deploymentName": {
              "description": "The deployment name to rollback to (required when type is SpecificDeployment)\n",
              "type": "string"
            },
            "type": {
              "description": "The type of on error deployment.\n- LastSuccessful: Rollback to last successful deployment\n- SpecificDeployment: Rollback to a specific deployment\n",
              "enum": [
                "LastSuccessful",
                "SpecificDeployment"
              ],
              "type": "string"
            }
          },
          "title": "Error Handling",
          "type": "object"
        },
        "parameters": {
          "additionalProperties": {
            "oneOf": [
              {
                "additionalProperties": false,
                "properties": {
                  "value": {
                    "description": "The parameter value"
                  }
                },
                "required": [
                  "value"
                ],
                "type": "object"
              },
              {
                "additionalProperties": false,
                "properties": {
                  "reference": {
                    "additionalProperties": false,
                    "description": "KeyVault reference for secure parameter values",
                    "properties": {
                      "keyVault": {
                        "additionalProperties": false,
                        "properties": {
                          "id": {
                            "description": "KeyVault resource ID",
                            "type": "string"
                          }
                        },
                        "type": "object"
                      },
                      "secretName": {
                        "description": "Name of the secret in KeyVault",
                        "type": "string"
                      },
                      "secretVersion": {
                        "description": "Version of the secret (optional)",
                        "type": "string"
                      }
                    },
                    "required": [
                      "keyVault",
                      "secretName"
                    ],
                    "type": "object"
                  }
                },
                "required": [
                  "reference"
                ],
                "type": "object"
              }
            ],
            "type": "object"
          },
          "description": "Template parameter values. Each parameter should be an object with a 'value' property\nor a 'reference' property for KeyVault references.\n\n`location` parameter is required to determine workerGroup.\n\nNote: The following parameters are automatically generated by worker-manager:\n- vmName, computerName, adminPassword, adminUsername, customData, tags\n\nVirtual machine `tags` must be placed correctly in order for worker-runner/generic-worker to function properly.\nSee: [Apply tags with ARM templates](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources-templates)\n\nYour ARM template MUST define these parameters in its parameters section,\neven though you don't provide values for them in the worker pool configuration.\nWorker-manager will automatically supply values for these when deploying.\n\nExample resource:\n\n  {\n    \"name\": \"[parameters('vmName')]\",\n    \"tags\": \"[parameters('tags')]\",\n    \"type\": \"Microsoft.Compute/virtualMachines\",\n    \"location\": \"[parameters('location')]\",\n    \"dependsOn\": [ \"[resourceId('Microsoft.Network/networkInterfaces', variables('nicName'))]\" ],\n    \"apiVersion\": \"2023-03-01\",\n    \"properties\": {\n      \"priority\": \"[parameters('priority')]\",\n      \"osProfile\": {\n        \"computerName\": \"[parameters('computerName')]\",\n        \"customData\": \"[parameters('customData')]\",\n        \"adminPassword\": \"[parameters('adminPassword')]\",\n        \"adminUsername\": \"[parameters('adminUsername')]\",\n        \"windowsConfiguration\": { \"timeZone\": \"UTC\", \"enableAutomaticUpdates\": true }\n      },\n      \"evictionPolicy\": \"[if(equals(parameters('priority'), 'Spot'), parameters('evictionPolicy'), json('null'))]\",\n      \"networkProfile\": {\n        \"networkInterfaces\": [ {\n          \"id\": \"[resourceId('Microsoft.Network/networkInterfaces', variables('nicName'))]\",\n          \"properties\": { \"deleteOption\": \"Delete\" }\n        }]\n      },\n      \"storageProfile\": {\n        \"imageReference\": { \"id\": \"[parameters('imageId')]\"},\n        \"osDisk\": {\n          \"osType\": \"Windows\",\n          \"caching\": \"[parameters('osDiskCaching')]\",\n          \"createOption\": \"FromImage\",\n          \"deleteOption\": \"Delete\",\n          \"diffDiskSettings\": { \"option\": \"[parameters('diffDiskOption')]\" }\n        },\n      },\n      \"hardwareProfile\": { \"vmSize\": \"[parameters('vmSize')]\" }\n    }\n  }\n",
          "required": [
            "location"
          ],
          "title": "Template Parameters",
          "type": "object"
        },
        "parametersLink": {
          "additionalProperties": false,
          "description": "SECURITY NOTE: External parameters may contain sensitive data.\nURI reference to an external parameters file.\n",
          "properties": {
            "contentVersion": {
              "description": "Parameters file content version",
              "type": "string"
            },
            "uri": {
              "description": "The URI of the parameters file",
              "type": "string"
            }
          },
          "title": "External Parameters Link",
          "type": "object"
        },
        "template": {
          "additionalProperties": true,
          "description": "The inline ARM template (self-contained).\nCannot be used with templateLink.\n",
          "title": "Inline Template",
          "type": "object"
        },
        "templateLink": {
          "description": "Reference to an external template or template spec.\nCannot be used with template.\n\nFor TEMPLATE SPECS (RECOMMENDED for production):\n- Use the 'id' property with full template spec resource ID\n- Template specs are versioned, secure, and support RBAC\n\nFor EXTERNAL TEMPLATES (NOT RECOMMENDED - use only for trusted sources):\n- Use the 'uri' property with template URL\n- For security, prefer Azure Storage with SAS tokens and access controls\n",
          "oneOf": [
            {
              "additionalProperties": false,
              "properties": {
                "id": {
                  "description": "Full resource ID of the Template Spec version.\nFormat: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Resources/templateSpecs/{specName}/versions/{version}\n",
                  "pattern": "^/subscriptions/[^/]+/resourceGroups/[^/]+/providers/Microsoft\\.Resources/templateSpecs/[^/]+/versions/[^/]+$",
                  "type": "string"
                }
              },
              "required": [
                "id"
              ],
              "type": "object"
            },
            {
              "additionalProperties": false,
              "properties": {
                "contentVersion": {
                  "description": "Template content version",
                  "type": "string"
                },
                "queryString": {
                  "description": "Query string for the URI (e.g., SAS token for blob storage)",
                  "type": "string"
                },
                "uri": {
                  "description": "Template URI. For security, prefer:\n- Azure Storage with SAS tokens and access controls\n- Private repositories with authentication\n- Internal artifact repositories\n",
                  "type": "string"
                }
              },
              "required": [
                "uri"
              ],
              "type": "object"
            }
          ],
          "title": "Template Link (External Template or Template Spec)",
          "type": "object"
        }
      },
      "required": [
        "mode"
      ],
      "title": "ARM Deployment Configuration",
      "type": "object"
    },
    "armDeploymentResourceGroup": {
      "description": "Override the resource group for the ARM deployment.\nBy default, resource group would be taken from Azure provider configuration provided at deployment time.\n\nIf resource group doesn't exist, it would be created in the region specified in the armDeployment template.\nIf multiple launch configs define same `armDeploymentResourceGroup` it would be created at most once.\n",
      "title": "Resource Group Override",
      "type": "string"
    }
  },
  "required": [
    "armDeployment"
  ],
  "title": "Azure Provider ARM Deployment Configuration",
  "type": "object"
}