Skip to main content

Deployment Architecture

Overview​

BankLingo is deployed on Microsoft Azure using a combination of Platform-as-a-Service (PaaS) and managed services. The deployment architecture emphasizes high availability, scalability, security, and operational excellence.

High-Level Deployment Diagram​

Azure Infrastructure Components​

Compute Layer​

Azure App Service​

Configuration:

  • Tier: Premium P2v3
  • Instances: 3 (auto-scale 3-10)
  • vCPUs: 2 per instance
  • Memory: 8 GB per instance
  • OS: Windows Server 2022
  • Runtime: .NET 8

Features Enabled:

  • ✅ Auto-scaling (CPU and memory based)
  • ✅ Application Insights integration
  • ✅ Deployment slots (Production, Staging, Development)
  • ✅ Always On enabled
  • ✅ HTTPS only enforcement
  • ✅ Managed identity for Azure resources

Scaling Rules:

  • Scale out when CPU > 70% for 5 minutes
  • Scale in when CPU < 30% for 10 minutes
  • Min instances: 3
  • Max instances: 10

Health Checks:

  • Endpoint: /health
  • Interval: 30 seconds
  • Unhealthy threshold: 3 failures

Data Layer​

Azure SQL Database​

Configuration:

  • Tier: Premium P2
  • DTUs: 250 DTUs
  • Storage: 500 GB
  • Max Database Size: 1 TB
  • Backup Retention: 35 days

High Availability:

  • ✅ Active Geo-Replication (Secondary region)
  • ✅ Zone-redundant configuration
  • ✅ Automated backups (Point-in-time restore)
  • ✅ Long-term retention (LTR) - 7 years

Performance Features:

  • Query Performance Insights enabled
  • Automatic tuning enabled
  • Query Store enabled
  • Intelligent Insights enabled

Security:

  • ✅ Transparent Data Encryption (TDE)
  • ✅ Always Encrypted for sensitive columns
  • ✅ Advanced Threat Protection
  • ✅ Auditing enabled (to Blob Storage)
  • ✅ Firewall rules (whitelist only)
  • ✅ Private endpoint configured

Connection String Management:

  • Stored in Azure Key Vault
  • Accessed via Managed Identity

Azure Cache for Redis​

Configuration:

  • Tier: Premium P1
  • Cache Size: 6 GB
  • Replicas: 1 (for HA)
  • Clustering: Disabled
  • Persistence: RDB snapshots enabled

Use Cases:

  • Session state management
  • Distributed caching
  • Process Engine state caching
  • Rate limiting counters
  • Temporary data storage

Security:

  • ✅ SSL/TLS only
  • ✅ Private endpoint
  • ✅ Access keys rotated quarterly
  • ✅ Redis password complexity enforced

Performance:

  • Maximum throughput: 100,000 requests/sec
  • Average latency: less than 1ms

Azure Blob Storage​

Configuration:

  • Account Type: StorageV2 (general purpose v2)
  • Replication: Geo-Redundant Storage (GRS)
  • Access Tier: Hot
  • Total Capacity: 10 TB

Containers:

  1. audit-logs - Audit trail storage
  2. documents - Document storage
  3. reports - Generated reports
  4. backups - Database backups
  5. process-attachments - BPMN attachments

Security:

  • ✅ Encryption at rest (Microsoft-managed keys)
  • ✅ Shared Access Signature (SAS) for temporary access
  • ✅ Private endpoints
  • ✅ Immutable storage (for compliance)
  • ✅ Soft delete enabled (90 days)

Lifecycle Management:

  • Move to Cool tier after 90 days
  • Move to Archive tier after 365 days
  • Delete after 7 years (compliance requirement)

Messaging Layer​

Azure Service Bus​

Configuration:

  • Tier: Premium
  • Messaging Units: 1
  • Max Message Size: 1 MB
  • Message TTL: 14 days

Queues:

  1. notification-queue - Email/SMS notifications
  2. batch-processing-queue - Batch jobs
  3. integration-queue - External system integration
  4. audit-queue - Audit event processing

Topics & Subscriptions:

  1. transaction-events topic
    • deposit-subscription
    • loan-subscription
    • audit-subscription

Features:

  • ✅ Dead-letter queue enabled
  • ✅ Duplicate detection (5-minute window)
  • ✅ Sessions enabled (for ordering)
  • ✅ Auto-forwarding configured
  • ✅ Geo-disaster recovery pairing

Monitoring & Observability​

Application Insights​

Configuration:

  • Sampling Rate: 10% (production)
  • Retention: 90 days
  • Daily Cap: 100 GB

Telemetry Collected:

  • Request telemetry (API calls)
  • Dependency telemetry (SQL, Redis, external APIs)
  • Exception telemetry
  • Custom events and metrics
  • Performance counters

Monitoring Dashboards:

  1. Application Performance - Response times, throughput
  2. Availability - Uptime, health checks
  3. Failures - Exceptions, failed requests
  4. Dependencies - External system health

Alerts Configured:

  • Response time > 5 seconds
  • Failure rate > 5%
  • Dependency failure rate > 10%
  • Exception count > 100/hour

Log Analytics Workspace​

Configuration:

  • Retention: 90 days (hot), 2 years (cold)
  • Daily Cap: 50 GB
  • Workspace Mode: Per-GB pricing

Data Sources:

  • Application Insights logs
  • App Service logs
  • SQL Database audit logs
  • Azure Activity logs
  • Security Center alerts

Kusto Queries (Saved):

  • Transaction volume by hour
  • Error rate by endpoint
  • Slow queries analysis
  • User activity patterns

Security Services​

Azure Key Vault​

Configuration:

  • Tier: Premium (HSM-backed keys)
  • Access Policy: RBAC-based
  • Soft Delete: Enabled (90 days)
  • Purge Protection: Enabled

Secrets Stored:

  • SQL connection strings
  • Redis connection strings
  • API keys (NIBSS, SMS, Email)
  • Encryption keys
  • SSL certificates

Key Rotation:

  • Automatic rotation every 90 days
  • Notification to security team

Azure Active Directory (AAD)​

Configuration:

  • Edition: Premium P2
  • Conditional Access: Enabled
  • MFA: Required for admin accounts

Application Registration:

  • BankLingo API (App ID)
  • Managed identities for Azure resources

RBAC Roles:

  • App Service Contributor
  • SQL DB Contributor
  • Key Vault Administrator
  • Monitoring Reader

Networking​

Azure Front Door​

Configuration:

  • Tier: Premium
  • Routing Method: Priority
  • Session Affinity: Enabled
  • Cache: Enabled (for static content)

Features:

  • ✅ Web Application Firewall (WAF)
  • ✅ DDoS Protection
  • ✅ SSL/TLS termination
  • ✅ Custom domains
  • ✅ CDN integration

WAF Rules:

  • OWASP Top 10 protection
  • Bot protection
  • Rate limiting (1000 requests/min per IP)
  • Geo-filtering (allow Nigeria only)

Virtual Network (VNet)​

Configuration:

  • Address Space: 10.0.0.0/16
  • Subnets:
    • App Service subnet: 10.0.1.0/24
    • SQL subnet: 10.0.2.0/24
    • Redis subnet: 10.0.3.0/24
    • Private Endpoints subnet: 10.0.10.0/24

Network Security Groups (NSGs):

  • Inbound: HTTPS (443) only
  • Outbound: SQL (1433), Redis (6380), HTTPS (443)

Private Endpoints:

  • SQL Database private endpoint
  • Redis Cache private endpoint
  • Blob Storage private endpoint
  • Service Bus private endpoint

Deployment Regions​

Primary Region: West Europe​

Rationale:

  • Low latency to Nigeria
  • Compliance with GDPR
  • Comprehensive Azure service availability

Services Deployed:

  • ✅ App Services (3 instances)
  • ✅ SQL Database (primary)
  • ✅ Redis Cache
  • ✅ Blob Storage (primary)
  • ✅ Service Bus
  • ✅ Application Insights

Secondary Region: North Europe (DR)​

Rationale:

  • Geo-redundancy
  • Disaster recovery
  • Data sovereignty compliance

Services Deployed:

  • ✅ SQL Database (geo-replica, read-only)
  • ✅ Blob Storage (geo-redundant copy)

Failover Strategy:

  • RTO (Recovery Time Objective): 1 hour
  • RPO (Recovery Point Objective): 5 minutes
  • Failover Type: Manual failover (with approval)

Failover Procedure:

  1. Assess primary region outage
  2. Promote secondary SQL to read-write
  3. Update DNS records (Azure Front Door)
  4. Provision App Services in secondary region
  5. Validate functionality
  6. Notify stakeholders

CI/CD Pipeline Architecture​

Build Pipeline​

Trigger: Commit to main branch

Steps:

  1. Restore NuGet packages
  2. Build solution (.NET 8)
  3. Run unit tests (xUnit)
  4. Run integration tests (TestContainers)
  5. Code coverage analysis (Coverlet)
  6. Security scan (SonarQube, OWASP Dependency Check)
  7. Build Docker image
  8. Push to Azure Container Registry

Build Artifacts:

  • Docker image (tagged with build number)
  • Database migration scripts
  • ARM templates
  • Release notes

Quality Gates:

  • Code coverage > 80%
  • No critical security vulnerabilities
  • No blocker/critical code smells
  • All tests passing

Release Pipeline​

Environments:

  1. Development

    • Auto-deploy: On successful build
    • Database: Separate Dev database
    • Purpose: Developer testing

  2. Staging

    • Deploy: Manual approval (Tech Lead)
    • Database: Clone of production (anonymized)
    • Purpose: QA testing, UAT

  3. Production

    • Deploy: Manual approval (DevOps + Product Owner)
    • Strategy: Blue-Green deployment
    • Database: Production database with migration
    • Purpose: Live environment

Deployment Strategy:

  • Blue-Green Deployment: Deploy to staging slot → Swap slots
  • Zero-downtime deployment
  • Automatic rollback on health check failure

Pre-Deployment Checks:

  • Database backup completed
  • Previous deployment slot available
  • Health check endpoint responding
  • Load balancer configured

Post-Deployment:

  • Smoke tests execution
  • Health check validation
  • Application Insights monitoring (15 minutes)
  • Rollback if failure rate > 5%

Deployment Configuration​

Environment Variables​

Managed via Azure App Configuration and Key Vault:

VariableSourcePurpose
ConnectionStrings__DefaultConnectionKey VaultSQL connection string
Redis__ConnectionStringKey VaultRedis connection string
ApplicationInsights__InstrumentationKeyApp ConfigAPM key
ServiceBus__ConnectionStringKey VaultMessaging queue
NIBSS__ApiKeyKey VaultPayment gateway
ASPNETCORE_ENVIRONMENTApp ConfigRuntime environment

Feature Flags​

Managed via Azure App Configuration:

Feature FlagPurposeDefault
EnableApprovalWorkflowTransaction approvalEnabled
EnableChequeClearingCheque processingEnabled
EnableBatchProcessingEOD batch jobsEnabled
EnableNotificationsEmail/SMSEnabled
MaintenanceModeMaintenance windowDisabled

Backup & Disaster Recovery​

Backup Strategy​

SQL Database:

  • Automated backups: Every 5 minutes (transaction log)
  • Full backups: Weekly
  • Differential backups: Daily
  • Retention: 35 days (short-term), 7 years (long-term)
  • Backup storage: Geo-redundant (GRS)

Blob Storage:

  • Soft delete: 90 days
  • Versioning: Enabled
  • Geo-replication: Automatic (GRS)

Redis Cache:

  • RDB snapshots: Daily
  • AOF persistence: Disabled (performance)
  • Backup retention: 7 days

Disaster Recovery​

DR Strategy: Active-Passive

RTO: 1 hour
RPO: 5 minutes

DR Scenarios:

  1. Single Component Failure

    • Action: Auto-recovery via redundancy
    • Example: App Service instance failure → Load balancer redirects

  2. Regional Outage

    • Action: Manual failover to secondary region
    • Steps:
      1. Promote SQL geo-replica
      2. Provision App Services in DR region
      3. Update Front Door backend pool
      4. Validate application functionality

  3. Data Corruption

    • Action: Point-in-time restore
    • Steps:
      1. Identify corruption timestamp
      2. Restore database to point before corruption
      3. Replay transactions from audit log (if needed)

DR Testing: Quarterly full DR drill

Infrastructure as Code (IaC)​

ARM Templates​

Template Structure:

infrastructure/
├── parameters/
│   ├── dev.parameters.json
│   ├── staging.parameters.json
│   └── production.parameters.json
├── templates/
│   ├── app-service.json
│   ├── sql-database.json
│   ├── redis-cache.json
│   ├── storage.json
│   ├── service-bus.json
│   └── main.json (orchestrator)
└── scripts/
    ├── deploy.ps1
    └── rollback.ps1

Deployment Command:

az deployment group create \
  --resource-group rg-banklingo-prod \
  --template-file main.json \
  --parameters @production.parameters.json

Cost Optimization​

Monthly Cost Estimate (Production)​

ServiceConfigurationEstimated Cost
App ServiceP2v3 x 3 instances$450/month
SQL DatabasePremium P2 (250 DTU)$930/month
Redis CachePremium P1 (6GB)$350/month
Blob Storage10TB Hot + GRS$210/month
Service BusPremium$677/month
Application Insights100GB/day$230/month
Azure Front DoorPremium + WAF$420/month
Log Analytics50GB/day$115/month
Key VaultPremium$1.25/month
Bandwidth5TB egress$410/month
Total~$3,800/month

Cost Optimization Strategies:

  • ✅ Auto-scaling (reduce instances during low traffic)
  • ✅ Reserved instances (1-year commitment, 30% savings)
  • ✅ Blob lifecycle management (move to cool/archive tiers)
  • ✅ Application Insights sampling (reduce telemetry volume)
  • ✅ SQL Database elastic pool (if more databases added)

Monitoring & Alerting​

Key Metrics Monitored​

Application Metrics:

  • Request rate (requests/sec)
  • Response time (P50, P95, P99)
  • Error rate (%)
  • Availability (%)

Infrastructure Metrics:

  • CPU utilization (%)
  • Memory utilization (%)
  • Disk I/O (IOPS)
  • Network throughput (Mbps)

Business Metrics:

  • Transaction volume (transactions/hour)
  • User activity (active users)
  • Process completion rate (%)
  • SLA compliance (%)

Alert Rules​

AlertConditionSeverityAction
High Error RateError rate > 5% for 5 minCriticalPage on-call engineer
Slow ResponseP95 > 5s for 10 minWarningEmail dev team
High CPUCPU > 85% for 10 minWarningAuto-scale trigger
Database DTUDTU > 90% for 5 minCriticalPage DBA, consider scale-up
Service UnavailableHealth check fails 3 timesCriticalPage on-call, initiate DR

Security Hardening​

Network Security​

  • ✅ NSG rules: Whitelist only
  • ✅ Private endpoints: All data services
  • ✅ WAF: OWASP Top 10 protection
  • ✅ DDoS Protection: Standard tier
  • ✅ TLS 1.2+: Enforced everywhere

Identity & Access​

  • ✅ Managed Identity: For Azure resource access
  • ✅ RBAC: Least privilege principle
  • ✅ MFA: Required for all admin access
  • ✅ Conditional Access: IP restrictions, device compliance

Data Security​

  • ✅ Encryption at rest: TDE, storage encryption
  • ✅ Encryption in transit: SSL/TLS everywhere
  • ✅ Key rotation: Quarterly for all keys
  • ✅ Secrets management: Azure Key Vault
  • ✅ Data masking: Sensitive columns in non-prod

Compliance & Governance​

Regulatory Compliance​

  • ✅ GDPR: Data residency in EU, right to erasure
  • ✅ PCI-DSS: Payment card data protection (if applicable)
  • ✅ CBN Guidelines: Central Bank of Nigeria compliance
  • ✅ SOC 2: Azure SOC 2 Type II certified

Azure Policy​

Policies Enforced:

  • Require tags on resources (CostCenter, Environment, Owner)
  • Enforce allowed resource locations (West Europe only)
  • Enforce SSL/TLS on all services
  • Require diagnostic logs enabled
  • Deny public IP addresses on data services

Summary​

The deployment architecture provides:

  • ✅ High Availability - Multi-instance deployment with auto-scaling
  • ✅ Disaster Recovery - Geo-redundant data with 1-hour RTO
  • ✅ Scalability - Auto-scale from 3 to 10 instances based on demand
  • ✅ Security - Multi-layered security with WAF, private endpoints, encryption
  • ✅ Monitoring - Comprehensive observability with Application Insights
  • ✅ Automation - CI/CD pipeline with blue-green deployment
  • ✅ Cost Optimization - Auto-scaling and lifecycle management
  • ✅ Compliance - GDPR, PCI-DSS, CBN guidelines adherence

Deployment Characteristics:

  • Availability: 99.95% SLA
  • Response Time: less than 500ms (P95)
  • Throughput: 10,000 requests/min
  • Concurrent Users: 5,000+
  • Data Retention: 7 years (compliance)