# Azure Acquisition Brief
**Cold Bore Ballistics LLC — Confidential**
Last updated: 2026-06-06

> This document summarizes the CBB Azure infrastructure for acquisition due diligence. Written for a buyer's technical or business team. For full operational detail, see `Azure_Architecture_Reference.md`, `Azure_Operating_Runbook.md`, and `Azure_Rebuild_Guide.md`.

---

## What It Is

Microsoft Azure is the cloud infrastructure platform for Cold Bore Ballistics LLC. All CBB Azure resources live in a single Pay-As-You-Go subscription (`Cold Bore Ballistics LLC`) in the `northcentralus` region. The entire infrastructure is defined as code in the `cbb-infra` Terraform repository — no hand-built resources exist.

---

## Infrastructure-as-Code

Every Azure resource is defined in Terraform (`cbb-infra` repo). This is an acquisition-critical property:

- **Fully reproducible** — the entire environment can be rebuilt from scratch in under two hours using the `cbb-infra` repo alone
- **Auditable** — every infrastructure change is a git commit with a reason
- **No tribal knowledge** — no resource was created by clicking in the portal; everything a buyer needs to understand, modify, or migrate the infrastructure is in the code
- **State files** stored in Azure Blob Storage (`stcbbtfstate`), isolated from application resources in their own resource group (`rg-cbb-tfstate`)

---

## Assets Included in Acquisition

### Always-Included (Core Infrastructure)

| Resource | Name | Purpose | Status |
|---|---|---|---|
| Azure subscription | `Cold Bore Ballistics LLC` | Billing boundary; all resources | Active |
| Entra ID tenant | `coldboreballisticsllc.com` | Identity and access management | Active |
| Resource group | `rg-cbb-prod` | All application resources | Active |
| Resource group | `rg-cbb-tfstate` | Terraform state isolation | Active |
| Virtual Network | `vnet-cbb-prod` (`10.0.0.0/16`) | Private network for all compute | Live |
| Subnet | `snet-cbb-prod` (`10.0.1.0/24`) | Application subnet | Live |
| Subnet | `snet-pg-prod` (`10.0.2.0/24`) | Delegated subnet for managed PostgreSQL | Live |
| Key Vault | `kv-cbb-shared-prod` | Corporate infrastructure secrets | Live |
| Key Vault | `kv-scope-dope-prod` | ScopeDOPE application secrets | Live |
| Terraform state storage | `stcbbtfstate` | State backend for all three services | Live |

### ScopeDOPE-Specific (transferable separately)

| Resource | Name | Purpose | Status |
|---|---|---|---|
| Container Registry | `crcbbprod` / `crcbbprod.azurecr.io` | Docker image registry for feedback-service | Live |
| Blob Storage | `stcbbprod` / `dope-uploads` | `.dope` file uploads from app | Live |
| Static Web App | `swa-scopedope-prod` | `www.scope-dope.com` marketing site | Live |
| Container App environment | `cae-cbb-prod` | Serverless container runtime | Live |
| Container App | `ca-feedback-prod` | feedback-service API (Flask) — **DEFERRED** | Live (placeholder image) |
| Managed PostgreSQL | `psql-cbb-prod` | Feedback database — Azure Database for PostgreSQL Flexible Server, private | Live |
| VM | `vm-infra-prod` (`infra.coldboreballisticsllc.com`) | IPsec site-to-site VPN gateway; general-purpose backend host | Live |
| IPsec VPN | Site-to-site Azure ↔ local network (strongSwan) | Secure private access between Azure and the office LAN | Live |

### CBB Corporate-Specific

| Resource | Name | Purpose | Status |
|---|---|---|---|
| Static Web App | `swa-cbb-prod` | `www.coldboreballisticsllc.com` company site | Live |

---

## Acquisition Boundary

The infrastructure is tagged and organized for clean product-line separation:

| Tag | ScopeDOPE resources | CBB Corporate resources |
|---|---|---|
| `project` | `scope-dope` | `cbb` |
| `cost_center` | `scopedope` | `cbb-corp` |
| `managed_by` | `terraform` | `terraform` |

**ScopeDOPE-only acquisition:** Transfer all resources tagged `project = scope-dope` from `rg-cbb-prod`, plus `kv-scope-dope-prod` and the `scopedope` Terraform state container from `stcbbtfstate`. The `shared` and `cbb` Terraform services, and `kv-cbb-shared-prod`, remain with CBB Corporate.

**Full acquisition:** Transfer the subscription. All resources, both Key Vaults, and all state files move as a unit.

The separation is enforced by Terraform service boundaries (`services/shared/`, `services/scope-dope/`, `services/cbb/`) and tag policy — not by convention. A buyer can verify the boundary in minutes using `az resource list --tag project=scope-dope`.

---

## Cost Profile

| Resource | Est. monthly cost | Notes |
|---|---|---|
| VM `Standard_B2pts_v2` | ~$15–20 | Live; always-on burstable ARM64 (IPsec gateway) |
| Managed PostgreSQL `psql-cbb-prod` | **$0 for 12 mo**, then ~$12–15 | B1ms + 32 GB free-tier; reminder set before expiry |
| Container App | ~$0–5 | Scales to zero when idle; charged on consumption |
| Container Registry (Basic) | ~$5 | Plus data transfer |
| Blob Storage | ~$1 | Minimal at current `.dope` upload volume |
| Static Web Apps (×2) | $0 | Free tier |
| VNet / Public IP | ~$3–5 | Static public IP for VM |
| Key Vaults (×2) | ~$0 | ~$0.03/10k ops; rounds to zero at CBB scale |
| Terraform state storage | ~$0 | Negligible |
| **Total estimate** | **~$25–30/month** (first 12 mo, DB free), then **~$37–45/month** | Update after first full billing cycle |

Actual costs are visible in Azure Cost Analysis filtered by `project` tag. ScopeDOPE and CBB costs are separately attributable.

---

## Security Posture

| Practice | Implementation |
|---|---|
| No secrets in code or Terraform state | All credentials in Azure Key Vault; never passed as Terraform variables |
| Managed identity for secret access | Container Apps use system-assigned managed identity — no API keys in app config |
| Key-only SSH | SSH to the gateway VM is key-only (Ed25519) — `PasswordAuthentication no`, no root password login. The port is internet-reachable but has no password surface to brute-force |
| Private database | Managed PostgreSQL is VNet-integrated with **no public endpoint** (public network access disabled); reachable only from inside the VNet / over the IPsec tunnel; TLS required |
| OIDC for CI/CD | GitHub Actions authenticates to Azure via OIDC federated identity — no client secrets |
| Infrastructure-as-code only | Zero hand-built resources; all changes are audited git commits |
| RBAC only | Key Vaults use RBAC exclusively; legacy access policies are disabled |
| Network-restricted Key Vaults | Both vaults have a network firewall (`default_action = Deny`) on top of RBAC — access is limited to the VNet-injected Container App's egress IP and the operator IP, plus trusted Azure services. Defense-in-depth beyond identity. |
| Managed-identity registry pulls | The container registry admin user is disabled; the Container App pulls images via its managed identity (AcrPull role) — no shared registry credential exists |
| Tag governance | Azure Policy inherits mandatory tags from the resource group, so no resource can be created untagged |
| Reproducible providers | `.terraform.lock.hcl` committed (azurerm 4.76.0 pinned); CI runs fmt/validate/tflint/tfsec on every PR |

---

## Open Items at Acquisition

| Item | Status | Impact |
|---|---|---|
| feedback-service | Explicitly deferred (Jira CBB-108, targets v1.1.0) | Container App provisioned with placeholder image; production Flask image not yet built/deployed (must listen on port 5001). All hosting infra is in place. |
| `github-token` secret | Placeholder (`PLACEHOLDER_ROTATE_ME`) | feedback-service issue-creation feature inert until a real GitHub PAT is set; no security exposure |
| GitHub Actions service principal | `sp-cbb-github-actions` deleted in the region migration, not yet recreated | CI cannot run Terraform until recreated (bootstrap.sh); applies are currently done locally via operator identity. Pipeline definition (`atlantis.yaml`, GHA workflows) is intact. |
| Managed DB free-tier expiry | $0 for the first 12 months, then ~$12–15/mo | An Outlook reminder is set ~1 month before expiry (2027-05-31) to decide keep/downsize/migrate |
| Actual cost baseline | Not yet established | Confirm after the first full billing cycle (all resources now live) |

None of these block a ScopeDOPE acquisition. The ScopeDOPE marketing site (`swa-scopedope-prod`) is live; the feedback service is deferred by design and is not customer-facing at launch.

---

## Credentials and Access

All infrastructure credentials are in Azure Key Vault. A buyer receives vault access as part of the subscription transfer. The Key Vault secret inventory is documented in `Azure_Key_Vault_Architecture_Reference.md`.

The Entra ID tenant (`coldboreballisticsllc.com`) includes the `sp-cbb-github-actions` service principal used by CI/CD, and the `claude-code-calendar` app registration for calendar automation. Both are documented and reproducible.

---

## Acquisition Recommendation

The Azure infrastructure is the strongest acquisition-readiness asset in the CBB stack. It is fully infrastructure-as-code, cost-tagged by product line, reproducible from scratch in under two hours, and has zero hand-built resources. The Key Vault integration means no credentials are exposed in code, state, or config files — a buyer can rotate every secret by updating Key Vault values without touching the application.

The full backend is live: PostgreSQL and the IPsec site-to-site VPN are operational, all three Terraform services are applied, and both websites are served from Azure Static Web Apps. The remaining work is the feedback-service application rework (deferred by design, tracked in Jira CBB-108) and recreating the CI service principal — application/operational follow-ups, not infrastructure design or code issues.

For a ScopeDOPE-only acquisition, the tag-based cost separation and Terraform service boundary make it straightforward to carve out exactly the ScopeDOPE assets, with documented identifiers for every resource.

---

## Document Control

| Field | Value |
|---|---|
| **Document owner** | `jschwefel@coldboreballisticsllc.com` |
| **Classification** | Confidential (03_-_Confidential/) |
| **Location** | `OneDrive/CBB_Corporate/03_-_Confidential/Infrastructure/Azure/Azure_Acquisition_Brief.md` |
| **Cross-references** | `Azure_Architecture_Reference.md`; `Azure_Operating_Runbook.md`; `Azure_Rebuild_Guide.md` |
| **Created** | 2026-06-07 |
| **Last updated** | 2026-06-07 |
| **Next full review due** | 2027-06-07 |

---

## Revision Control Block

| Rev | Date | Changed By | Reviewed By | Approved By | Summary |
|-----|------|------------|-------------|-------------|---------|
| 0.9 | 2026-06-07 | jschwefel | — | — | Initial release |
