Harden WAF deployment: private backend ingress and frontend proxy routing

Ashwal-Microsoft · Ashwal-Microsoft · commit 6bb94a02069c · 2026-04-23T01:48:35.000+05:30
diff --git a/docs/DeploymentGuide.md b/docs/DeploymentGuide.md
@@ -194,6 +194,13 @@ Review the configuration options below. You can customize any settings that meet
 | **Framework**          | Basic configuration               | [Well-Architected Framework](https://learn.microsoft.com/en-us/azure/well-architected/) |
 | **Features**           | Core functionality                | Reliability, security, operational excellence                                           |
 
+When using the Production/WAF deployment (`enablePrivateNetworking=true`), networking is configured as follows:
+
+- Backend Container App endpoints are internal-only (`ingressExternal=false`) and not publicly reachable.
+- Container Apps Environment is deployed in internal mode with VNet integration.
+- The web frontend remains public and routes browser API traffic through same-origin `/api` proxying to the private backend over VNet.
+- Private DNS is configured for the internal Container Apps Environment domain.
+
 **To use production configuration:**
 
 Copy the contents from the production configuration file to your main parameters file:
diff --git a/docs/TechnicalArchitecture.md b/docs/TechnicalArchitecture.md
@@ -177,6 +177,8 @@ The API also provides schema management, schema set (collection) management, and
 ### Claim Process Monitor Web
 Using Azure Container App, this app acts as the UI for the process monitoring queue. The app is built with React and TypeScript. It acts as an API client to create an experience for uploading new documents, creating and managing claim batches, monitoring current and historical processes, and reviewing output results including summarization and gap analysis.
 
+In WAF/private networking deployments (`enablePrivateNetworking=true`), the frontend remains public while backend APIs are internal-only. The web container proxies `/api/*` traffic to the private API Container App over VNet so backend endpoints are not directly exposed to the public internet.
+
 ### App Configuration
 Using Azure App Configuration, app settings and configurations are centralized and used with the Content Processor, Content Process API, Content Process Workflow, and Claim Process Monitor Web.
 
diff --git a/infra/main.bicep b/infra/main.bicep
@@ -931,7 +931,8 @@ module avmContainerAppEnv 'br/public:avm/res/app/managed-environment:0.13.2' = {
       }
     ]
     enableTelemetry: enableTelemetry
-    publicNetworkAccess: 'Enabled' // Always enabled for Container Apps Environment
+    publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled'
+    internal: enablePrivateNetworking ? true : false
 
     // <========== WAF related parameters
 
@@ -944,6 +945,34 @@ module avmContainerAppEnv 'br/public:avm/res/app/managed-environment:0.13.2' = {
   }
 }
 
+// ========== Private DNS Zone for internal Container App Environment ========== //
+// When the CAE is internal, its FQDN is resolvable only within the VNet via this zone.
+module caeDnsZone 'br/public:avm/res/network/private-dns-zone:0.8.0' = if (enablePrivateNetworking) {
+  name: take('avm.res.network.private-dns-zone.cae.${solutionSuffix}', 64)
+  params: {
+    name: avmContainerAppEnv.outputs.defaultDomain
+    tags: tags
+    enableTelemetry: enableTelemetry
+    a: [
+      {
+        name: '*'
+        aRecords: [
+          {
+            ipv4Address: avmContainerAppEnv.outputs.staticIp
+          }
+        ]
+        ttl: 300
+      }
+    ]
+    virtualNetworkLinks: [
+      {
+        name: take('vnetlink-${virtualNetworkResourceName}-cae', 64)
+        virtualNetworkResourceId: virtualNetwork!.outputs.resourceId
+      }
+    ]
+  }
+}
+
 // //=========== Managed Identity for Container Registry ========== //
 module avmContainerRegistryReader 'br/public:avm/res/managed-identity/user-assigned-identity:0.5.0' = {
   name: take('avm.res.managed-identity.user-assigned-identity.${solutionSuffix}', 64)
@@ -1132,7 +1161,7 @@ module avmContainerApp_API 'br/public:avm/res/app/container-app:0.22.1' = {
         }
       ]
     }
-    ingressExternal: true
+    ingressExternal: enablePrivateNetworking ? false : true
     activeRevisionsMode: 'Single'
     ingressTransport: 'auto'
     corsPolicy: {
@@ -1201,6 +1230,10 @@ module avmContainerApp_Web 'br/public:avm/res/app/container-app:0.22.1' = {
         env: [
           {
             name: 'APP_API_BASE_URL'
+            value: enablePrivateNetworking ? '/api' : 'https://${avmContainerApp_API.outputs.fqdn}'
+          }
+          {
+            name: 'APP_BACKEND_API_URL'
             value: 'https://${avmContainerApp_API.outputs.fqdn}'
           }
           {
@@ -1808,7 +1841,7 @@ module avmContainerApp_API_update 'br/public:avm/res/app/container-app:0.22.1' =
         }
       ]
     }
-    ingressExternal: true
+    ingressExternal: enablePrivateNetworking ? false : true
     activeRevisionsMode: 'Single'
     ingressTransport: 'auto'
     corsPolicy: {
diff --git a/infra/main_custom.bicep b/infra/main_custom.bicep
@@ -934,7 +934,8 @@ module avmContainerAppEnv 'br/public:avm/res/app/managed-environment:0.13.2' = {
       }
     ]
     enableTelemetry: enableTelemetry
-    publicNetworkAccess: 'Enabled' // Always enabled for Container Apps Environment
+    publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled'
+    internal: enablePrivateNetworking ? true : false
 
     // <========== WAF related parameters
 
@@ -947,6 +948,34 @@ module avmContainerAppEnv 'br/public:avm/res/app/managed-environment:0.13.2' = {
   }
 }
 
+// ========== Private DNS Zone for internal Container App Environment ========== //
+// When the CAE is internal, its FQDN is resolvable only within the VNet via this zone.
+module caeDnsZone 'br/public:avm/res/network/private-dns-zone:0.8.0' = if (enablePrivateNetworking) {
+  name: take('avm.res.network.private-dns-zone.cae.${solutionSuffix}', 64)
+  params: {
+    name: avmContainerAppEnv.outputs.defaultDomain
+    tags: tags
+    enableTelemetry: enableTelemetry
+    a: [
+      {
+        name: '*'
+        aRecords: [
+          {
+            ipv4Address: avmContainerAppEnv.outputs.staticIp
+          }
+        ]
+        ttl: 300
+      }
+    ]
+    virtualNetworkLinks: [
+      {
+        name: take('vnetlink-${virtualNetworkResourceName}-cae', 64)
+        virtualNetworkResourceId: virtualNetwork!.outputs.resourceId
+      }
+    ]
+  }
+}
+
 // //=========== Managed Identity for Container Registry ========== //
 module avmContainerRegistryReader 'br/public:avm/res/managed-identity/user-assigned-identity:0.5.0' = {
   name: take('avm.res.managed-identity.user-assigned-identity.${solutionSuffix}', 64)
@@ -1145,7 +1174,7 @@ module avmContainerApp_API 'br/public:avm/res/app/container-app:0.22.1' = {
         }
       ]
     }
-    ingressExternal: true
+    ingressExternal: enablePrivateNetworking ? false : true
     activeRevisionsMode: 'Single'
     ingressTransport: 'auto'
     corsPolicy: {
@@ -1219,6 +1248,10 @@ module avmContainerApp_Web 'br/public:avm/res/app/container-app:0.22.1' = {
         env: [
           {
             name: 'APP_API_BASE_URL'
+            value: enablePrivateNetworking ? '/api' : 'https://${avmContainerApp_API.outputs.fqdn}'
+          }
+          {
+            name: 'APP_BACKEND_API_URL'
             value: 'https://${avmContainerApp_API.outputs.fqdn}'
           }
           {
@@ -1841,7 +1874,7 @@ module avmContainerApp_API_update 'br/public:avm/res/app/container-app:0.22.1' =
         }
       ]
     }
-    ingressExternal: true
+    ingressExternal: enablePrivateNetworking ? false : true
     activeRevisionsMode: 'Single'
     ingressTransport: 'auto'
     corsPolicy: {
diff --git a/src/ContentProcessorWeb/env.sh b/src/ContentProcessorWeb/env.sh
@@ -6,5 +6,6 @@ do
     echo $key=$value
     # Use sed to replace only the exact matches of the key
     find /usr/share/nginx/html -type f -exec sed -i "s|\b${key}\b|${value}|g" '{}' +
+    sed -i "s|\b${key}\b|${value}|g" /etc/nginx/nginx.conf
 done
 echo 'done'
diff --git a/src/ContentProcessorWeb/nginx-custom.conf b/src/ContentProcessorWeb/nginx-custom.conf
@@ -18,6 +18,18 @@ http {
         listen 3000;
         server_name localhost;
 
+        # Route browser API calls through the web container so private backend
+        # endpoints remain internal-only in WAF/private networking deployments.
+        location /api/ {
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_pass APP_BACKEND_API_URL/;
+        }
+
         location / {
             root /usr/share/nginx/html;
             try_files $uri $uri/ /index.html;

Original file line number	Diff line number	Diff line change
`@@ -931,7 +931,8 @@ module avmContainerAppEnv 'br/public:avm/res/app/managed-environment:0.13.2' = {`
`931`	`931`	`}`
`932`	`932`	`]`
`933`	`933`	`enableTelemetry: enableTelemetry`
`934`		`- publicNetworkAccess: 'Enabled' // Always enabled for Container Apps Environment`
	`934`	`+ publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled'`
	`935`	`+ internal: enablePrivateNetworking ? true : false`
`935`	`936`
`936`	`937`	`// <========== WAF related parameters`
`937`	`938`
`@@ -944,6 +945,34 @@ module avmContainerAppEnv 'br/public:avm/res/app/managed-environment:0.13.2' = {`
`944`	`945`	`}`
`945`	`946`	`}`
`946`	`947`
	`948`	`+// ========== Private DNS Zone for internal Container App Environment ========== //`
	`949`	`+// When the CAE is internal, its FQDN is resolvable only within the VNet via this zone.`
	`950`	`+module caeDnsZone 'br/public:avm/res/network/private-dns-zone:0.8.0' = if (enablePrivateNetworking) {`
	`951`	`+ name: take('avm.res.network.private-dns-zone.cae.${solutionSuffix}', 64)`
	`952`	`+ params: {`
	`953`	`+ name: avmContainerAppEnv.outputs.defaultDomain`
	`954`	`+ tags: tags`
	`955`	`+ enableTelemetry: enableTelemetry`
	`956`	`+ a: [`
	`957`	`+ {`
	`958`	`+ name: '*'`
	`959`	`+ aRecords: [`
	`960`	`+ {`
	`961`	`+ ipv4Address: avmContainerAppEnv.outputs.staticIp`
	`962`	`+ }`
	`963`	`+ ]`
	`964`	`+ ttl: 300`
	`965`	`+ }`
	`966`	`+ ]`
	`967`	`+ virtualNetworkLinks: [`
	`968`	`+ {`
	`969`	`+ name: take('vnetlink-${virtualNetworkResourceName}-cae', 64)`
	`970`	`+ virtualNetworkResourceId: virtualNetwork!.outputs.resourceId`
	`971`	`+ }`
	`972`	`+ ]`
	`973`	`+ }`
	`974`	`+}`
	`975`	`+`
`947`	`976`	`// //=========== Managed Identity for Container Registry ========== //`
`948`	`977`	`module avmContainerRegistryReader 'br/public:avm/res/managed-identity/user-assigned-identity:0.5.0' = {`
`949`	`978`	`name: take('avm.res.managed-identity.user-assigned-identity.${solutionSuffix}', 64)`
`@@ -1132,7 +1161,7 @@ module avmContainerApp_API 'br/public:avm/res/app/container-app:0.22.1' = {`
`1132`	`1161`	`}`
`1133`	`1162`	`]`
`1134`	`1163`	`}`
`1135`		`- ingressExternal: true`
	`1164`	`+ ingressExternal: enablePrivateNetworking ? false : true`
`1136`	`1165`	`activeRevisionsMode: 'Single'`
`1137`	`1166`	`ingressTransport: 'auto'`
`1138`	`1167`	`corsPolicy: {`
`@@ -1201,6 +1230,10 @@ module avmContainerApp_Web 'br/public:avm/res/app/container-app:0.22.1' = {`
`1201`	`1230`	`env: [`
`1202`	`1231`	`{`
`1203`	`1232`	`name: 'APP_API_BASE_URL'`
	`1233`	`+ value: enablePrivateNetworking ? '/api' : 'https://${avmContainerApp_API.outputs.fqdn}'`
	`1234`	`+ }`
	`1235`	`+ {`
	`1236`	`+ name: 'APP_BACKEND_API_URL'`
`1204`	`1237`	`value: 'https://${avmContainerApp_API.outputs.fqdn}'`
`1205`	`1238`	`}`
`1206`	`1239`	`{`
`@@ -1808,7 +1841,7 @@ module avmContainerApp_API_update 'br/public:avm/res/app/container-app:0.22.1' =`
`1808`	`1841`	`}`
`1809`	`1842`	`]`
`1810`	`1843`	`}`
`1811`		`- ingressExternal: true`
	`1844`	`+ ingressExternal: enablePrivateNetworking ? false : true`
`1812`	`1845`	`activeRevisionsMode: 'Single'`
`1813`	`1846`	`ingressTransport: 'auto'`
`1814`	`1847`	`corsPolicy: {`
Original file line number	Diff line number	Diff line change
`@@ -934,7 +934,8 @@ module avmContainerAppEnv 'br/public:avm/res/app/managed-environment:0.13.2' = {`
`934`	`934`	`}`
`935`	`935`	`]`
`936`	`936`	`enableTelemetry: enableTelemetry`
`937`		`- publicNetworkAccess: 'Enabled' // Always enabled for Container Apps Environment`
	`937`	`+ publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled'`
	`938`	`+ internal: enablePrivateNetworking ? true : false`
`938`	`939`
`939`	`940`	`// <========== WAF related parameters`
`940`	`941`
`@@ -947,6 +948,34 @@ module avmContainerAppEnv 'br/public:avm/res/app/managed-environment:0.13.2' = {`
`947`	`948`	`}`
`948`	`949`	`}`
`949`	`950`
	`951`	`+// ========== Private DNS Zone for internal Container App Environment ========== //`
	`952`	`+// When the CAE is internal, its FQDN is resolvable only within the VNet via this zone.`
	`953`	`+module caeDnsZone 'br/public:avm/res/network/private-dns-zone:0.8.0' = if (enablePrivateNetworking) {`
	`954`	`+ name: take('avm.res.network.private-dns-zone.cae.${solutionSuffix}', 64)`
	`955`	`+ params: {`
	`956`	`+ name: avmContainerAppEnv.outputs.defaultDomain`
	`957`	`+ tags: tags`
	`958`	`+ enableTelemetry: enableTelemetry`
	`959`	`+ a: [`
	`960`	`+ {`
	`961`	`+ name: '*'`
	`962`	`+ aRecords: [`
	`963`	`+ {`
	`964`	`+ ipv4Address: avmContainerAppEnv.outputs.staticIp`
	`965`	`+ }`
	`966`	`+ ]`
	`967`	`+ ttl: 300`
	`968`	`+ }`
	`969`	`+ ]`
	`970`	`+ virtualNetworkLinks: [`
	`971`	`+ {`
	`972`	`+ name: take('vnetlink-${virtualNetworkResourceName}-cae', 64)`
	`973`	`+ virtualNetworkResourceId: virtualNetwork!.outputs.resourceId`
	`974`	`+ }`
	`975`	`+ ]`
	`976`	`+ }`
	`977`	`+}`
	`978`	`+`
`950`	`979`	`// //=========== Managed Identity for Container Registry ========== //`
`951`	`980`	`module avmContainerRegistryReader 'br/public:avm/res/managed-identity/user-assigned-identity:0.5.0' = {`
`952`	`981`	`name: take('avm.res.managed-identity.user-assigned-identity.${solutionSuffix}', 64)`
`@@ -1145,7 +1174,7 @@ module avmContainerApp_API 'br/public:avm/res/app/container-app:0.22.1' = {`
`1145`	`1174`	`}`
`1146`	`1175`	`]`
`1147`	`1176`	`}`
`1148`		`- ingressExternal: true`
	`1177`	`+ ingressExternal: enablePrivateNetworking ? false : true`
`1149`	`1178`	`activeRevisionsMode: 'Single'`
`1150`	`1179`	`ingressTransport: 'auto'`
`1151`	`1180`	`corsPolicy: {`
`@@ -1219,6 +1248,10 @@ module avmContainerApp_Web 'br/public:avm/res/app/container-app:0.22.1' = {`
`1219`	`1248`	`env: [`
`1220`	`1249`	`{`
`1221`	`1250`	`name: 'APP_API_BASE_URL'`
	`1251`	`+ value: enablePrivateNetworking ? '/api' : 'https://${avmContainerApp_API.outputs.fqdn}'`
	`1252`	`+ }`
	`1253`	`+ {`
	`1254`	`+ name: 'APP_BACKEND_API_URL'`
`1222`	`1255`	`value: 'https://${avmContainerApp_API.outputs.fqdn}'`
`1223`	`1256`	`}`
`1224`	`1257`	`{`
`@@ -1841,7 +1874,7 @@ module avmContainerApp_API_update 'br/public:avm/res/app/container-app:0.22.1' =`
`1841`	`1874`	`}`
`1842`	`1875`	`]`
`1843`	`1876`	`}`
`1844`		`- ingressExternal: true`
	`1877`	`+ ingressExternal: enablePrivateNetworking ? false : true`
`1845`	`1878`	`activeRevisionsMode: 'Single'`
`1846`	`1879`	`ingressTransport: 'auto'`
`1847`	`1880`	`corsPolicy: {`