Azure DDoS protection #107

.gitignore

@@ -113,4 +113,5 @@ node_modules
 .project
 
 # Specific azuredeploy.parameters.json files for dev testing (ignored not to expose ssh pub keys)
-.params/
+.params/
+.vs/

azuredeploy.json

@@ -72,6 +72,13 @@
             },
             "type": "bool"
         },
+        "ddosSwitch": {
+            "defaultValue": false,
+            "metadata": {
+                "description": "Switch to create a DDoS protection plan"
+            },
+            "type": "bool"
+        },
         "httpsTermination": {
             "allowedValues": [
                 "VMSS",
@@ -901,6 +908,8 @@
             "dbLoginPassword": "[concat(substring(uniqueString(resourceGroup().id, deployment().name), 2, 11), '*7', toUpper('pfiwb'))]",
             "dbServerType": "[parameters('dbServerType')]",
             "dbUsername": "[concat(parameters('dbLogin'), '@', parameters('dbServerType'), '-', variables('resourceprefix'))]",
+            "ddosPlanName": "[concat('ddos-plan-',variables('resourceprefix'))]",
+            "ddosSwitch": "[parameters('ddosSwitch')]",
             "elasticVmSku": "[parameters('elasticVmSku')]",
             "elasticAvailabilitySetName": "[concat('elastic-avset-',variables('resourceprefix'))]",
             "elasticClusterName": "[concat('es-cluster-',variables('resourceprefix'))]",

docs/Manage.md

@@ -173,6 +173,24 @@ files to be ready immediately:
   - /moodle/certs/nginx.key: Your certificate's private key
   - /moodle/certs/nginx.crt: Your combined signed certificate and trust chain certificate(s).
 
+## Managing Azure DDoS protection
+
+By default, every plublic IP is protected by Azure DDoS protection Basic SKU. 
+You can find more information about Azure DDoS protection Basic SKU [here](https://docs.microsoft.com/en-us/azure/virtual-network/ddos-protection-overview).
+
+If you want more protection, you can activate Azure DDoS protection Standard SKU by setting 
+the ddosSwith to true. You can find how to work with Azure DDoS 
+protection plan [here](https://docs.microsoft.com/en-us/azure/virtual-network/manage-ddos-protection#work-with-ddos-protection-plans).
+
+If you want to disable the Azure DDoS protection, you can follow the instruction 
+[here](https://docs.microsoft.com/en-us/azure/virtual-network/manage-ddos-protection#disable-ddos-for-a-virtual-network). 
+
+Be careful, disabling the Azure DDoS protection on your vnet will not stop the fee.
+You have to delete the Azure DDoS protection plan if you want to stop the fee.
+
+If you have deployed your cluster without Azure DDoS protection plan, you still can activate the 
+Azure DDoS protection plan thanks to the instruction [here](https://docs.microsoft.com/en-us/azure/virtual-network/manage-ddos-protection#enable-ddos-for-an-existing-virtual-network).
+
 ## Next Steps
 
   1. [Retrieve configuration details using CLI](./Get-Install-Data.md)

docs/Parameters.md

@@ -187,6 +187,15 @@ Possible Values: ["postgres","mysql","mssql"]
 
 Default: mysql
 
+### ddosSwitch
+
+Switch to create an Azure DDoS protection plan and link it to the vnet
+
+Type: bool
+
+Possible Values: [true, false]
+
+Default: false
 
 ### elasticVmSku
 

nested/network-vnet-ddos.json

@@ -0,0 +1,56 @@
+{
+    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
+    "contentVersion": "1.0.0.0",
+    "parameters": {
+        "moodleCommon": {
+            "metadata": {
+                "description": "Common Moodle values"
+            },
+            "type": "object"
+        },
+        "vnetName": {
+            "metadata": {
+                "description": "The name of the vnet to which the DDoS protection plan shoud be associated"
+            },
+            "type": "string"
+        },
+        "vNetAddressSpace": {
+            "metadata": {
+                "description": "The vNet Address Space to which the DDoS protection plan shoud be associated"
+            },
+            "type": "string"
+        }
+    },
+    "resources": [
+        {
+            "type": "Microsoft.Network/ddosProtectionPlans",
+            "apiVersion": "2018-02-01",
+            "condition": "[parameters('moodleCommon').ddosSwitch]",
+            "location": "[resourceGroup().location]",
+            "name": "[parameters('moodleCommon').ddosPlanName]"
+        },
+        {
+            "type": "Microsoft.Network/virtualNetworks",
+            "apiVersion": "2018-02-01",
+            "dependsOn": [
+                "[resourceId('Microsoft.Network/ddosProtectionPlans', parameters('moodleCommon').ddosPlanName)]"
+            ],
+            "location": "[resourceGroup().location]",
+            "name": "[parameters('vnetName')]",
+            "properties": {
+                "addressSpace": {
+                    "addressPrefixes": [
+                        "[parameters('vNetAddressSpace')]"
+                    ]
+                },
+                "ddosProtectionPlan": {
+                    "id": "[resourceId('Microsoft.Network/ddosProtectionPlans', parameters('moodleCommon').ddosPlanName)]"
+                },
+                "enableDdosProtection": "[parameters('moodleCommon').ddosSwitch]"
+            }
+        }
+    ],
+    "variables": {
+        "documentation01": "This sub-template creates a Azure DDoS protection plan and link it to a vnet"
+    }
+}

nested/network.json

@@ -27,11 +27,40 @@
                 }
             }
         },
+        {
+            "apiVersion": "2018-02-01",
+            "condition": "[parameters('moodleCommon').ddosSwitch]",
+            "dependsOn": [
+                "Microsoft.Resources/deployments/vnetTemplate"
+            ],
+            "name": "ddosTemplate",
+            "subscriptionId": "[variables('vnetSub')]",
+            "resourceGroup": "[variables('vnetRg')]",
+            "properties": {
+                "mode": "Incremental",
+                "parameters": {
+                    "moodleCommon": {
+                        "value": "[parameters('moodleCommon')]"
+                    },
+                    "vnetName": {
+                        "value": "[variables('vnetName')]"
+                    },
+                    "vNetAddressSpace": {
+                        "value": "[if(equals(parameters('moodleCommon').customVnetId, ''), concat(parameters('moodleCommon').vNetAddressSpace,'/16'), reference(parameters('moodleCommon').customVnetId, '2017-10-01').addressSpace.addressPrefixes[0])]"
+                    }
+                },
+                "templateLink": {
+                    "uri": "[concat(parameters('moodleCommon').baseTemplateUrl,'network-vnet-ddos.json',parameters('moodleCommon').artifactsSasToken)]"
+                }
+            },
+            "type": "Microsoft.Resources/deployments"
+        },
         {
             "type": "Microsoft.Resources/deployments",
             "apiVersion": "2017-05-10",
             "dependsOn": [
-                "Microsoft.Resources/deployments/vnetTemplate"
+                "Microsoft.Resources/deployments/vnetTemplate",
+                "Microsoft.Resources/deployments/ddosTemplate"
             ],
             "name": "subnetTemplate",
             "subscriptionId": "[variables('vnetSub')]",