Enterprise-Grade MCP Servers: App Gateway + Internal APIM + Container Apps

#!/usr/bin/env bash
#
# Scenario 3: App Gateway → APIM (Internal VNet) → Container App (VNet)
#
# Architecture:
#   [Internet] → [App Gateway (public, WAF)] → [APIM (internal VNet)]
#                                                       ↓
#                                              [Container App (VNet-only)]
#
# The MCP endpoint is exposed through App Gateway.
#
# Usage: ./scripts/deploy-appgw.sh
#
set -euo pipefail

#-----------------------------------------------------------------------
# Configuration
#-----------------------------------------------------------------------
RESOURCE_GROUP="mcp-demo-appgw-rg"
LOCATION="eastus"
ACR_NAME="mcpappgwacr$(openssl rand -hex 3)"
VNET_NAME="mcp-appgw-vnet"
ACA_SUBNET_NAME="aca-subnet"
APIM_SUBNET_NAME="apim-subnet"
APPGW_SUBNET_NAME="appgw-subnet"
ACA_ENV_NAME="mcp-appgw-env"
ACA_APP_NAME="product-catalog-appgw"
APIM_NAME="mcp-appgw-apim-$(openssl rand -hex 3)"
APPGW_NAME="mcp-appgw"
APPGW_PIP_NAME="mcp-appgw-pip"
APIM_ORG="MCP Demo AppGW"
APIM_EMAIL="admin@mcpdemo.com"
API_ID="product-catalog-appgw"
IMAGE_TAG="product-catalog-api:v1"

echo "======================================================="
echo " Scenario 3: App Gateway → APIM (Internal) → ACA"
echo "======================================================="

#-----------------------------------------------------------------------
# Step 1: Create Resource Group
#-----------------------------------------------------------------------
echo ""
echo "▶ Step 1: Creating resource group '$RESOURCE_GROUP'..."
az group create --name "$RESOURCE_GROUP" --location "$LOCATION" --output none
echo "  ✅ Resource group created."

#-----------------------------------------------------------------------
# Step 2: Create VNet with 3 subnets
#-----------------------------------------------------------------------
echo ""
echo "▶ Step 2: Creating VNet with 3 subnets..."
az network vnet create \
  --resource-group "$RESOURCE_GROUP" \
  --name "$VNET_NAME" \
  --address-prefix "10.1.0.0/16" \
  --location "$LOCATION" \
  --output none

# ACA subnet
az network vnet subnet create \
  --resource-group "$RESOURCE_GROUP" \
  --vnet-name "$VNET_NAME" \
  --name "$ACA_SUBNET_NAME" \
  --address-prefix "10.1.0.0/23" \
  --delegations "Microsoft.App/environments" \
  --output none

# APIM subnet
az network vnet subnet create \
  --resource-group "$RESOURCE_GROUP" \
  --vnet-name "$VNET_NAME" \
  --name "$APIM_SUBNET_NAME" \
  --address-prefix "10.1.2.0/24" \
  --output none

# App Gateway subnet
az network vnet subnet create \
  --resource-group "$RESOURCE_GROUP" \
  --vnet-name "$VNET_NAME" \
  --name "$APPGW_SUBNET_NAME" \
  --address-prefix "10.1.3.0/24" \
  --output none

ACA_SUBNET_ID=$(az network vnet subnet show \
  --resource-group "$RESOURCE_GROUP" --vnet-name "$VNET_NAME" \
  --name "$ACA_SUBNET_NAME" --query id -o tsv)

APIM_SUBNET_ID=$(az network vnet subnet show \
  --resource-group "$RESOURCE_GROUP" --vnet-name "$VNET_NAME" \
  --name "$APIM_SUBNET_NAME" --query id -o tsv)

echo "  ✅ VNet and subnets created."
echo "      ACA subnet:     10.1.0.0/23"
echo "      APIM subnet:    10.1.2.0/24"
echo "      App GW subnet:  10.1.3.0/24"

#-----------------------------------------------------------------------
# Step 3: Create ACR + Build image
#-----------------------------------------------------------------------
echo ""
echo "▶ Step 3: Creating ACR and building image..."
az acr create \
  --resource-group "$RESOURCE_GROUP" \
  --name "$ACR_NAME" \
  --sku Basic \
  --admin-enabled true \
  --output none

az acr build \
  --registry "$ACR_NAME" \
  --image "$IMAGE_TAG" \
  --file Dockerfile . \
  --no-logs
echo "  ✅ Image built and pushed."

#-----------------------------------------------------------------------
# Step 4: Create Container Apps environment (internal)
#-----------------------------------------------------------------------
echo ""
echo "▶ Step 4: Creating internal Container Apps environment..."
az containerapp env create \
  --resource-group "$RESOURCE_GROUP" \
  --name "$ACA_ENV_NAME" \
  --location "$LOCATION" \
  --infrastructure-subnet-resource-id "$ACA_SUBNET_ID" \
  --internal-only true \
  --output none

ACA_DEFAULT_DOMAIN=$(az containerapp env show \
  --resource-group "$RESOURCE_GROUP" --name "$ACA_ENV_NAME" \
  --query "properties.defaultDomain" -o tsv)

ACA_STATIC_IP=$(az containerapp env show \
  --resource-group "$RESOURCE_GROUP" --name "$ACA_ENV_NAME" \
  --query "properties.staticIp" -o tsv)

echo "  ✅ ACA environment created."
echo "      Domain: $ACA_DEFAULT_DOMAIN"
echo "      IP:     $ACA_STATIC_IP"

#-----------------------------------------------------------------------
# Step 5: Deploy Container App (external ingress = VNet-accessible)
#-----------------------------------------------------------------------
echo ""
echo "▶ Step 5: Deploying Container App..."
ACR_LOGIN_SERVER="${ACR_NAME}.azurecr.io"
ACR_PASSWORD=$(az acr credential show --name "$ACR_NAME" --query "passwords[0].value" -o tsv)

az containerapp create \
  --resource-group "$RESOURCE_GROUP" \
  --name "$ACA_APP_NAME" \
  --environment "$ACA_ENV_NAME" \
  --image "${ACR_LOGIN_SERVER}/${IMAGE_TAG}" \
  --registry-server "$ACR_LOGIN_SERVER" \
  --registry-username "$ACR_NAME" \
  --registry-password "$ACR_PASSWORD" \
  --target-port 3000 \
  --ingress external \
  --min-replicas 1 \
  --max-replicas 3 \
  --output none

APP_FQDN=$(az containerapp show \
  --resource-group "$RESOURCE_GROUP" --name "$ACA_APP_NAME" \
  --query "properties.configuration.ingress.fqdn" -o tsv)

echo "  ✅ Container App deployed: https://${APP_FQDN}"
echo "     (VNet-only, not internet-accessible)"

#-----------------------------------------------------------------------
# Step 6: Private DNS for Container Apps
#-----------------------------------------------------------------------
echo ""
echo "▶ Step 6: Setting up Private DNS..."
az network private-dns zone create \
  --resource-group "$RESOURCE_GROUP" \
  --name "$ACA_DEFAULT_DOMAIN" \
  --output none

az network private-dns link vnet create \
  --resource-group "$RESOURCE_GROUP" \
  --zone-name "$ACA_DEFAULT_DOMAIN" \
  --name "aca-dns-link" \
  --virtual-network "$VNET_NAME" \
  --registration-enabled false \
  --output none

az network private-dns record-set a add-record \
  --resource-group "$RESOURCE_GROUP" \
  --zone-name "$ACA_DEFAULT_DOMAIN" \
  --record-set-name "*" \
  --ipv4-address "$ACA_STATIC_IP" \
  --output none

echo "  ✅ Private DNS configured."

#-----------------------------------------------------------------------
# Step 7: NSG + Service Endpoints for APIM subnet
#-----------------------------------------------------------------------
echo ""
echo "▶ Step 7: Configuring NSG and service endpoints..."

az network vnet subnet update \
  --resource-group "$RESOURCE_GROUP" \
  --vnet-name "$VNET_NAME" \
  --name "$APIM_SUBNET_NAME" \
  --service-endpoints Microsoft.EventHub Microsoft.KeyVault Microsoft.ServiceBus Microsoft.Sql Microsoft.Storage \
  --output none

az network nsg create \
  --resource-group "$RESOURCE_GROUP" \
  --name "apim-nsg" \
  --location "$LOCATION" \
  --output none

az network nsg rule create \
  --resource-group "$RESOURCE_GROUP" \
  --nsg-name "apim-nsg" \
  --name "AllowAPIMManagement" \
  --priority 100 --direction Inbound --access Allow --protocol Tcp \
  --source-address-prefixes ApiManagement \
  --destination-port-ranges 3443 \
  --output none

az network nsg rule create \
  --resource-group "$RESOURCE_GROUP" \
  --nsg-name "apim-nsg" \
  --name "AllowAppGateway" \
  --priority 110 --direction Inbound --access Allow --protocol Tcp \
  --source-address-prefixes "10.1.3.0/24" \
  --destination-port-ranges 443 \
  --output none

az network vnet subnet update \
  --resource-group "$RESOURCE_GROUP" \
  --vnet-name "$VNET_NAME" \
  --name "$APIM_SUBNET_NAME" \
  --network-security-group "apim-nsg" \
  --output none

echo "  ✅ NSG and service endpoints configured."

#-----------------------------------------------------------------------
# Step 7b: NSG for App Gateway subnet (allow HTTP:80 inbound)
#-----------------------------------------------------------------------
echo ""
echo "▶ Step 7b: Configuring App Gateway subnet NSG..."
az network nsg create \
  --resource-group "$RESOURCE_GROUP" \
  --name "appgw-nsg" \
  --location "$LOCATION" \
  --output none

az network nsg rule create \
  --resource-group "$RESOURCE_GROUP" \
  --nsg-name "appgw-nsg" \
  --name "AllowHTTP" \
  --priority 100 --direction Inbound --access Allow --protocol Tcp \
  --source-address-prefixes Internet \
  --destination-port-ranges 80 \
  --output none

az network nsg rule create \
  --resource-group "$RESOURCE_GROUP" \
  --nsg-name "appgw-nsg" \
  --name "AllowGatewayManager" \
  --priority 200 --direction Inbound --access Allow --protocol Tcp \
  --source-address-prefixes GatewayManager \
  --destination-port-ranges 65200-65535 \
  --output none

az network vnet subnet update \
  --resource-group "$RESOURCE_GROUP" \
  --vnet-name "$VNET_NAME" \
  --name "$APPGW_SUBNET_NAME" \
  --network-security-group "appgw-nsg" \
  --output none

echo "  ✅ App Gateway NSG configured (HTTP:80 + GatewayManager)."

#-----------------------------------------------------------------------
# Step 8: Create APIM (Internal VNet mode)
#-----------------------------------------------------------------------
echo ""
echo "▶ Step 8: Creating APIM with Internal VNet mode..."
echo "  ⏳ This takes 30-45 minutes..."

az apim create \
  --resource-group "$RESOURCE_GROUP" \
  --name "$APIM_NAME" \
  --publisher-name "$APIM_ORG" \
  --publisher-email "$APIM_EMAIL" \
  --sku-name Developer \
  --location "$LOCATION" \
  --output none

echo "  ✅ APIM instance created. Applying VNet integration..."

az apim update \
  --resource-group "$RESOURCE_GROUP" \
  --name "$APIM_NAME" \
  --virtual-network Internal \
  --set "virtualNetworkConfiguration.subnetResourceId=$APIM_SUBNET_ID" \
  --output none

APIM_PRIVATE_IP=$(az apim show \
  --resource-group "$RESOURCE_GROUP" --name "$APIM_NAME" \
  --query "privateIpAddresses[0]" -o tsv 2>/dev/null || echo "pending")

echo "  ✅ APIM deployed (Internal VNet mode)."
echo "      Private IP: $APIM_PRIVATE_IP"
echo "      Gateway:    ${APIM_NAME}.azure-api.net (VNet-only)"

#-----------------------------------------------------------------------
# Step 9: Private DNS for APIM
#-----------------------------------------------------------------------
echo ""
echo "▶ Step 9: Setting up Private DNS for APIM..."

# Internal APIM requires private DNS to resolve *.azure-api.net within the VNet
az network private-dns zone create \
  --resource-group "$RESOURCE_GROUP" \
  --name "azure-api.net" \
  --output none

az network private-dns link vnet create \
  --resource-group "$RESOURCE_GROUP" \
  --zone-name "azure-api.net" \
  --name "apim-dns-link" \
  --virtual-network "$VNET_NAME" \
  --registration-enabled false \
  --output none

# Re-fetch private IP (might not have been available immediately)
APIM_PRIVATE_IP=$(az apim show \
  --resource-group "$RESOURCE_GROUP" --name "$APIM_NAME" \
  --query "privateIpAddresses[0]" -o tsv)

az network private-dns record-set a add-record \
  --resource-group "$RESOURCE_GROUP" \
  --zone-name "azure-api.net" \
  --record-set-name "$APIM_NAME" \
  --ipv4-address "$APIM_PRIVATE_IP" \
  --output none

echo "  ✅ APIM Private DNS configured."
echo "      ${APIM_NAME}.azure-api.net → $APIM_PRIVATE_IP"

#-----------------------------------------------------------------------
# Step 10: Import API into APIM
#-----------------------------------------------------------------------
echo ""
echo "▶ Step 10: Importing API into APIM..."

az apim api import \
  --resource-group "$RESOURCE_GROUP" \
  --service-name "$APIM_NAME" \
  --api-id "$API_ID" \
  --path "products" \
  --specification-format OpenApiJson \
  --specification-path "openapi.json" \
  --service-url "https://${APP_FQDN}" \
  --display-name "Product Catalog API (AppGW)" \
  --protocols https \
  --subscription-required false \
  --output none

echo "  ✅ API imported."

#-----------------------------------------------------------------------
# Step 11: Create App Gateway (public-facing)
#-----------------------------------------------------------------------
echo ""
echo "▶ Step 11: Creating Application Gateway..."

# Public IP for App Gateway
az network public-ip create \
  --resource-group "$RESOURCE_GROUP" \
  --name "$APPGW_PIP_NAME" \
  --sku Standard \
  --allocation-method Static \
  --location "$LOCATION" \
  --output none

APPGW_PIP=$(az network public-ip show \
  --resource-group "$RESOURCE_GROUP" --name "$APPGW_PIP_NAME" \
  --query ipAddress -o tsv)

echo "  App Gateway Public IP: $APPGW_PIP"

# Create App Gateway with APIM as backend
az network application-gateway create \
  --resource-group "$RESOURCE_GROUP" \
  --name "$APPGW_NAME" \
  --location "$LOCATION" \
  --sku Standard_v2 \
  --capacity 1 \
  --vnet-name "$VNET_NAME" \
  --subnet "$APPGW_SUBNET_NAME" \
  --public-ip-address "$APPGW_PIP_NAME" \
  --http-settings-port 443 \
  --http-settings-protocol Https \
  --frontend-port 80 \
  --servers "$APIM_PRIVATE_IP" \
  --priority 100 \
  --output none

echo "  ✅ App Gateway created."

#-----------------------------------------------------------------------
# Step 12: Configure App Gateway for APIM backend
#-----------------------------------------------------------------------
echo ""
echo "▶ Step 12: Configuring App Gateway routing to APIM..."

# Update backend HTTP settings to use APIM hostname
az network application-gateway http-settings update \
  --resource-group "$RESOURCE_GROUP" \
  --gateway-name "$APPGW_NAME" \
  --name "appGatewayBackendHttpSettings" \
  --host-name "${APIM_NAME}.azure-api.net" \
  --protocol Https \
  --port 443 \
  --output none

# Create a health probe for APIM
az network application-gateway probe create \
  --resource-group "$RESOURCE_GROUP" \
  --gateway-name "$APPGW_NAME" \
  --name "apim-probe" \
  --protocol Https \
  --host "${APIM_NAME}.azure-api.net" \
  --path "/status-0123456789abcdef" \
  --interval 30 \
  --timeout 30 \
  --threshold 3 \
  --output none

# Associate probe with HTTP settings
az network application-gateway http-settings update \
  --resource-group "$RESOURCE_GROUP" \
  --gateway-name "$APPGW_NAME" \
  --name "appGatewayBackendHttpSettings" \
  --probe "apim-probe" \
  --output none

echo "  ✅ App Gateway configured to route to APIM."

#-----------------------------------------------------------------------
# Step 13: MCP Server Setup Instructions
#-----------------------------------------------------------------------
echo ""
echo "▶ Step 13: Exposing API as MCP Server..."
echo ""
echo "  📋 MANUAL STEP (Portal):"
echo "  ─────────────────────────────────────────────────"
echo "  1. Azure Portal → APIM: ${APIM_NAME}"
echo "  2. MCP Servers → + Create MCP server"
echo "  3. Expose an API as MCP server"
echo "  4. Select 'Product Catalog API (AppGW)'"
echo "  5. Select all operations → Create"
echo "  ─────────────────────────────────────────────────"
echo ""

#-----------------------------------------------------------------------
# Summary
#-----------------------------------------------------------------------
echo "======================================================="
echo " DEPLOYMENT COMPLETE — Scenario 3 (App Gateway)"
echo "======================================================="
echo ""
echo " Resource Group:    $RESOURCE_GROUP"
echo " VNet:              $VNET_NAME (10.1.0.0/16)"
echo ""
echo " Container App:     https://${APP_FQDN}"
echo "                    (VNet-only, not internet-accessible)"
echo ""
echo " APIM:              ${APIM_NAME}.azure-api.net"
echo "                    (Internal VNet, private IP: $APIM_PRIVATE_IP)"
echo ""
echo " App Gateway:       http://${APPGW_PIP}  (public)"
echo "                    Routes to APIM internal endpoint"
echo ""
echo " Architecture:"
echo "   [Internet] → [App GW :${APPGW_PIP}] → [APIM (internal)] → [Container App]"
echo ""
echo " MCP Endpoint (after portal step):"
echo "   http://${APPGW_PIP}/mcp"
echo ""
echo " Test with MCP Inspector:"
echo "   npx @modelcontextprotocol/inspector"
echo "   → Transport: Streamable HTTP"
echo "   → URL: http://${APPGW_PIP}/mcp"
echo ""

# Save outputs
cat > scripts/.env-appgw <<EOF
RESOURCE_GROUP=$RESOURCE_GROUP
VNET_NAME=$VNET_NAME
ACR_NAME=$ACR_NAME
ACA_ENV_NAME=$ACA_ENV_NAME
ACA_APP_NAME=$ACA_APP_NAME
APIM_NAME=$APIM_NAME
APIM_PRIVATE_IP=$APIM_PRIVATE_IP
APPGW_NAME=$APPGW_NAME
APPGW_PIP=$APPGW_PIP
APP_FQDN=$APP_FQDN
MCP_ENDPOINT=http://${APPGW_PIP}/mcp
EOF

echo " Environment saved to scripts/.env-appgw"