Anyone have any experience with Elixir on Microsoft Azure?

(full disclosure: I work for Microsoft, and love Elixir )

Hi,

I haven’t yet spent too much time on the actual runtime side of Elixir on Azure. One thing I did was to run a Distillery with multi-stage docker, then push the resulting image to Azure Web Apps (with Linux). Also Azure Kubernetes Service (AKS) is an obvious solution. When it comes to running an Erlang Cluster in a virtual network, there are no reasons why it should not be possible…

Regarding your question on whether Azure plays well with BEAM instrumentation, I would guess all BEAM things would be independent of or orthogonal to Azure?

As for the Elixir application side of things, I started to build libraries to interact with various Azure APIs:

• The chgeuer/ex_microsoft_azure_management_generator repo is a utility which auto-generates a big chunk of client-side proxies for the Azure Resource Manager (ARM) management API.
• You can find the generated code in ex_microsoft_azure_management.
• I have a sample project ex_microsoft_azure_management_samples which demonstrates how for example to list or create resource groups, or how to trigger an ARM deployment.
• The thing where I spend some more love was on the application plane, particularly with the Azure Storage API. The ex_microsoft_azure_storage project shows you how to interact with Azure blob storage. This is an early stage API client, but works for me ™.
• Ramon (a colleague) created an Azure KeyVault client ex_azure_key_vault

Feel free to ping me via mail (chgeuer@microsoft)…

How did your setup look like?

Terraform with its state stored on s3 (could be azure’s alternative), distillery with docker to build releases (on CI) and upload them to s3 (could be azure’s alternative), epmdless distribution over azure’s vpn (might later move to partisan).

Did you use Azure Container Instances or Azure Virtual Machines?

Azure Virtual Machines (mostly the spot instances)

Did you deploy to a single node or multiple nodes?

Multiple. No issues.

Were you using some kind of containers and orchestration, e.g. Docker and Kubernetes?

No, but we used some bash scripts though which would download the releases from s3 and then enable and start the apps via systemd.

Does Azure play well with BEAM instrumentation and debugging tools?

Since it’s just a linux instance, it works as any other linux instance (which is ok).

Did you experience any significant difficulties?

It would be a bit too expensive for us if it wasn’t for the spot instances.

Jackpot!

I’m not knowledgeable enough about the inner workings of the BEAM and surrounding tooling to answer that question. Based on what I’ve read and heard in various Elixir podcasts, some hosting services and cloud services impose certain restrictions, but I don’t know all of the details.

Thank you for taking the time to respond and sharing your work! This is very useful.

Hello @chgeuer how would you do this today? especially with releases introduced. I would love to know how you deploy docker images to Azure Web Apps, connect to a Postgres database on Azure, run migrations and seed the database.

I am also interested in your experiences @chgeuer . Automating it using Terraform would also be interesting I think… do you take this route?

Hi @dumadi, once your Elixir app is in a Docker image, you can host it (like any other workload) in Azure App Services, Azure Kubernetes Services or Azure Container Apps. When connecting to PostgreSQL on Azure, you just have to ensure that your workload uses TLS to connect to the PostgreSQL database.

@hoetmaaiers, apologies, not clear what the Q is. Terraform is kind-of the outer part. From an Elixir perspective, I guess the Azure-specific Qs are how can an Elixir workload talk to platform-specific services. Whether you deploy an Elixir workload to Azure using Bicep, ARM, Terraform, Pulumi or something seems not the big concern to me?

any chance you have a working TLS configuration? Because mine worked for months and now I just can’t connect to the database without anything changing. Tried updating certs, all kinds of conf combinations… i just don’t get it. Here’s what it is now:

  config :viru, Viru.Repo,
    url: database_url,
    pool_size: String.to_integer(System.get_env("POOL_SIZE") || "10"),
    socket_options: maybe_ipv6,
    ssl: [
      verify: :verify_peer,
      cacertfile: "/app/certs/DigiCertGlobalRootCA.crt.pem",
      server_name_indication: ~c"my-db-app-name.postgres.database.azure.com",
      versions: [:"tlsv1.2"]
    ]

and I keep getting the error

2024-11-13T13:09:00.381980945Z 13:09:00.346 [notice] TLS :client: In state :certify at ssl_handshake.erl:2177 generated CLIENT ALERT: Fatal - Unknown CA
2024-11-13T13:09:00.382128545Z 
2024-11-13T13:09:00.420272963Z 13:09:00.419 [error] Postgrex.Protocol (#PID<0.151.0>) failed to connect: ** (DBConnection.ConnectionError) ssl connect: TLS client: In state certify at ssl_handshake.erl:2177 generated CLIENT ALERT: Fatal - Unknown CA
2024-11-13T13:09:00.420344963Z  - {:tls_alert, {:unknown_ca, ~c"TLS client: In state certify at ssl_handshake.erl:2177 generated CLIENT ALERT: Fatal - Unknown CA\n"}}
2024-11-13T13:09:00.420351963Z 13:09:00.419 [error] Postgrex.Protocol (#PID<0.150.0>) failed to connect: ** (DBConnection.ConnectionError) ssl connect: TLS client: In state certify at ssl_handshake.erl:2177 generated CLIENT ALERT: Fatal - Unknown CA

And here as well

I wrote a quick blog article about it here

thanks for the effort @chgeuer . but i don’t really understand why is “Entra application” suddenly required in the first place? it seems to me i just need the correct SSL options.

edit: I was finally able to figure it out thanks to this thread: How to connect an elixir application with Azure Database for PostgreSQL using SSL certificate? - #14 by KristerV

but i’m still curious what is this Entra application stuff, why is it needed? does it simplify anything?