Azure

The engine runs in an Azure subscription of yours, as Terraform your own GitLab pipeline applies. Models are called through Azure OpenAI, in your subscription and region, by the gateway’s identity alone.

The one-click stack

In LightHouse, Setup and admin → Where agents run, choose Azure, a region and a profile, then Get my stack. LightHouse gives you two files:

1. lighthouse-bootstrap.bicep, deployed into an existing resource group. Open your Azure console opens the portal’s custom deployment page; load the file there. It creates a user-assigned identity, lighthouse-deploy-<tenant id>, with a federated credential that only your GitLab project’s main branch can use. No secret is created.
2. main.tf, which calls Atlantic’s Azure module at a pinned version. Your pipeline applies it from main, as a reviewed merge request.

What to have ready

• A subscription, and Azure OpenAI model deployments you are allowed to create in your region.
• A GitLab project whose CI runs with OIDC.
• The app and gateway images, the gateway policy, the address ranges allowed in, your monthly budget, its start date and the addresses for alerts.
• A runner inside your network, or your deployer’s address ranges: the Key Vault is private.

What it creates

Area	Resources
Network	A resource group and a virtual network with subnets for the apps (delegated to Container Apps), private endpoints and the database, default outbound access off; network security groups; a NAT gateway; private DNS zones
Keys and secrets	A premium Key Vault (RBAC, purge protection, 90-day soft delete, private endpoint); an RSA-HSM 3072 data key rotated every two years; the gateway’s token, policy and the app’s key as secrets
Logs	A Log Analytics workspace, with diagnostics for the activity log, the vault and the database
Database	Azure Database for PostgreSQL Flexible Server, with an Entra administrator; or SQLite on Azure Files
Budget	A subscription budget alerting at 80% forecast and 100% actual
Compute	A Container Apps environment with the gateway and app container apps; optional jobs, relay, reader and command channel
Models	An Azure OpenAI account with your own key and a private endpoint, a content filter policy, and model deployments that never upgrade on their own
Sign-in	Optional Container Apps authentication

Permissions

Identity	Holds
lighthouse-deploy-<tenant id> (the pipeline)	Contributor on the resource group it is deployed into
Gateway (the only identity that may call a model)	Cognitive Services OpenAI User on the model account
App	No role
Runtime	Key Vault Secrets User
Keys	Key Vault Crypto Service Encryption User

Turning models_enabled off removes the gateway’s model role: a second kill switch, which Azure applies within minutes rather than instantly. See Suspension.

The SQLite-on-Azure-Files option keeps the storage account’s shared key on, because Container Apps mounts the share with it. The flexible server option has no such key.

Regions

LightHouse offers westeurope (the default), northeurope, uksouth, eastus and westus2. Every resource is in the location you choose; geography-wide names (europe, uk, global) are refused. Model deployments may be only Standard or ProvisionedManaged: Global and DataZone deployments, which can process in other regions, are refused. See Regions.

Deployment profiles

	Always-on	Ephemeral
Gateway	Two warm replicas	Scales to zero; the first request wakes it
Relay	One replica	Zero, woken by the first post
Content reader, command channel	Container apps	Container Apps jobs every minute
Product	One replica	One replica
Estimated cost a month (westeurope, the lines that differ)	$247.77	$68.15

The estimated saving is $179.62 a month. Wake times on Azure are estimates. The database is not changed by the profile. Set deployment_profile, plan and apply. See Deployment profiles.

Upgrading and removing the stack

• Upgrade: move the module’s pinned tag in a reviewed merge request. See Upgrades.
• Remove: the Key Vault has purge protection, so its name is held for its soft-delete period. Removal is not automated Coming.