Connect your network

Peer your network with the install's, add the DNS records and verify access. Private access only.

With private access, the platform is reachable only from a network you peer with the install's virtual network, under the hostnames you chose. Isomer holds no role on your network, so these steps are yours. Run them after the install finishes, signed in to your own tenant.

Peering

Peering has two halves: from your network to the install's, and from the install's back to yours. The second sits inside the managed resource group; the install allows you to create it even though the rest of that group is locked.

az account set --subscription {subscription-id}
ISOMER_VNET_ID=$(az network vnet list -g {managed-resource-group} --query "[0].id" -o tsv)
YOUR_VNET_ID=$(az network vnet show -g {your-network-resource-group} -n {your-network} --query id -o tsv)
az network vnet peering create -g {your-network-resource-group} --vnet-name {your-network} \
  -n to-isomer --remote-vnet "$ISOMER_VNET_ID" --allow-vnet-access
az network vnet peering create -g {managed-resource-group} --vnet-name "${ISOMER_VNET_ID##*/}" \
  -n to-{your-network} --remote-vnet "$YOUR_VNET_ID" --allow-vnet-access
az network vnet peering list -g {your-network-resource-group} --vnet-name {your-network} \
  --query "[].{name:name, state:peeringState}" -o table

to-isomer should show Connected.

DNS

Add these records in whatever DNS your network resolves through:

• Your three hostnames, pointing at the install's ingress address.
• The storage account's private-link name, {account}.privatelink.blob.core.windows.net, pointing at its private endpoint, so browsers download documents over the peering.

Both addresses are outputs of the managed application:

APP_ID=$(az managedapp list --query "[0].id" -o tsv)
az managedapp show --ids "$APP_ID" --query "{ingress:outputs.ingressPrivateIp.value, records:outputs.dnsRecords.value}" -o json

With Azure Private DNS, that is a zone for your hostnames' domain holding the three records, and a privatelink.blob.core.windows.net zone holding the storage record, both linked to your network.

Verify

From a machine in your network, with your root certificate saved as root.crt, each hostname should resolve to the ingress address and pass TLS verification (0). The API answers 401 because it expects a token, the workflow console 200, and the dashboards 302 to their sign-in:

for h in {api-hostname} {temporal-hostname} {grafana-hostname}; do
  printf "%-40s %s  " "$h" "$(getent hosts "$h" | cut -d' ' -f1)"
  curl -sS --cacert root.crt -o /dev/null -w "HTTP %{http_code}  TLS verify: %{ssl_verify_result}\n" --max-time 15 "https://$h/"
done
curl -sS --cacert root.crt https://{api-hostname}/health

The last line should print {"status":"healthy"}. A command that hangs instead of answering points at the peering or the DNS.

Browsers

The web app, at your address under isomer.ai, calls your API from the user's browser, so it works in browsers inside your network that resolve your hostnames and trust your certificate authority.

Next steps