Deploy Hugo Static Website to Azure (Terraform + GitHub Actions)

# Install Hugo via Winget.
winget install Hugo.Hugo.Extended

# Ubuntu, Debian
sudo apt install hugo

# Fedora, RHEL
sudo dnf install hugo

brew install hugo

# Create new directory for the project and change into it.
mkdir my_website
cd my_website

# Initialize Git in current project directory and set branch as `main`.
git init -b main

# Add the GitHub repository as the remote source named `origin`.
git remote add origin https://github.com/user-name/my-website

# Pull down the existing remote repository (empty at this point).
git pull origin main

hugo new site ./src

Congratulations! Your new Hugo project was created in [path].

title = "Test Site"
baseURL = "http://localhost"
theme = "LoveIt"
themesDir = "./themes"

# Start Hugo local server.
hugo serve -s ./src -w

Built in 274 ms
Environment: "development"
Serving pages from disk
Running in Fast Render Mode. For full rebuilds on change: hugo server --disableFastRender
Web Server is available at http://localhost:1313/ (bind address 127.0.0.1)
Press Ctrl+C to stop

terraform {
  required_version = ">= 1.5.0"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 4.0"
    }
    # OPTIONAL: Used for Cloudflare resources (DNS, domains, etc).
    cloudflare = {
      source = "cloudflare/cloudflare"
      version = "5.8.2"
    }
    # Used for generating time-based resources, used for timestamps in names or tags.
    time = {
      source = "hashicorp/time"
      version = "0.13.1"
    }
    # Used for GitHub resources, such as repositories, uploading secrets to Github Actions.
    github = {
      source  = "integrations/github"
      version = "~> 6.0"
    }
  }
}

# Provider configurations.
# These are the providers that will be used in the Terraform configuration.
provider "azurerm" {
  subscription_id = var.azure_sub_id # Replace the associated variable with your Azure subscription ID.
  tenant_id = var.azure_tenant_id # Replace the associated variable with your Azure tenant ID.
  features {}
}
provider "cloudflare" {
  api_token = var.cloudflare_config.api_token # Replace the associated variable with your Cloudflare API token.
}
provider "github" {
  owner = var.github_config.org_user # Replace the associated variable with your GitHub org/user.
}

# Output the hostname assigned to the SWA.
output "swa_default_hostname" {
  value = azurerm_static_web_app.swa.default_host_name
}

# Deployment token to be used by GitHub Actions workflow to deploy the SWA in Azure.
output "swa_deployment_token" {
  value     = azurerm_static_web_app.swa.api_key
  sensitive = true # To view: terraform output -raw swa_deployment_token
}

### Variables ###

variable "azure_tenant_id" {
    type = string
    description = "Azure tenant ID, used for auth."
}

variable "azure_sub_id" {
    type = string
    description = "Azure subscritpion ID, used for resource deployment."
}

variable "location" {
    type = string
    description = "Default/preferred location for resource deployment."
}

variable "tags" {
  type        = map(string)
  description = "Tags to be applied to resources."
}

variable "naming" {
    description = "Map of values defining the naming conventions for resources."
    type = map(string)
}

variable "github_config" {
    description = "Map of values defining the GitHub configuration."
    type = map(string)
}

variable "cloudflare_config" {
    description = "Map of values defining the Cloudflare configuration."
    type = map(string)
}

variable "custom_domain_name" {
  type = string
  description = "OPTIONAL: Custom domain name to be used for the Azure Static Web App."
  default = "" # Example: "www.example.com". If left empty, the SWA will only have the default Azure hostname.
}

# Azure
azure_tenant_id = "12345-abcd-1234-efgh-1234567890"
azure_sub_id = "12345-abcd-1234-efgh-1234567890"
location = "westus2" # SWA is limited to specific regions.
# Optional: Custom domain name to be used for the Azure Static Web App.
custom_domain_name = "www.website.com" # Example: "www.example.com". If left empty, the SWA will only have the default Azure hostname.

# Naming Conventions
naming = {                 # Map of name related variables.
    org_prefix       = "abc" # Organization abbreviated name. Example: "abc" (Azure Balloon Company).
    workload_project = "www-myapp-com" # Workload project, overall category or additional grouping name. 
    environment      = "dev" # alz, plz, dev, tst, prd.
}

tags = {
    Organization = "MyOrg"           # Name or abbreviation used to identify the organisation.  
    CreatedBy    = "IaC-Terraform"       # Name of the user or service that created the resources.
    Owner        = "My Name"          # Name of the individual or team responsible for the resources.
    Project      = "www-myapp-com" # Workload/project name, used to group and identify related resources.
    Environment  = "dev"                 # alz, plz, dev, tst, prd.
}

github_config = {
    org_user   = "my-account" # Name of the repository organization owner. 
    repository = "www-myapp-com" # Repository where this project is stored. 
    branch     = "main" # Name of the default repository branch.
}

# Cloudflare: https://developers.cloudflare.com/fundamentals/api/get-started/create-token/
cloudflare_config = {
  zone_id   = "1234567890" # Cloudflare zone ID for the custom domain.
  api_token = "123456789" # Cloudflare API token with permissions to manage DNS records.
  dnshost   = "www" # Subdomain to be used for the CNAME record, 'www' for www.example.com.
}

### Main ###

# Azure: Resource group for the project.
resource "azurerm_resource_group" "main" {
  name          = "rg-${var.naming.org_prefix}-${var.naming.workload_project}-${var.naming.environment}"
  location      = var.location
  tags          = var.tags
}

# Azure: Static Web App
resource "azurerm_static_web_app" "main" {
  name                  = "swa-${var.naming.org_prefix}-${var.naming.workload_project}-${var.naming.environment}"
  resource_group_name   = azurerm_resource_group.main.name
  location              = azurerm_resource_group.main.location
  sku_tier              = "Free" # or "Standard"
  tags                  = var.tags
}

# Cloudflare: Add auto-generated SWA DNS name as CNAME record for custom domain check."
resource "cloudflare_dns_record" "record" {
  zone_id = "${var.cloudflare_config.zone_id}"
  name = "${var.custom_domain_name}"
  ttl = 60 # 60 seconds, can update later on.
  type = "CNAME" # Can be "A" or "TXT" depending on your setup.
  comment = "Azure - ${var.naming.workload_project} - Domain verification record" # Adds a comment for clarity.
  content = azurerm_static_web_app.main.default_host_name # Supplied by Azure SWA resource after creation.
  proxied = false # Required to be 'false' for DNS verification.
}

# Sleep while DNS propagates (it can take a few minutes).
resource "time_sleep" "wait_for_dns" {
  create_duration = "180s"
  depends_on = [
    cloudflare_dns_record.record
  ]
}

# Azure: Add custom domain to SWA, after waiting for DNS.
resource "azurerm_static_web_app_custom_domain" "swa_domain" {
  static_web_app_id = azurerm_static_web_app.main.id
  domain_name       = "${var.custom_domain_name}"
  validation_type   = "cname-delegation" # dns-txt-token
  depends_on = [
    time_sleep.wait_for_dns # Only deploy if this resource succeeds.
  ]
}

# GitHub Actions: Upload secret (deployment token) for the SWA.
resource "github_actions_secret" "swa_token" {
  repository      = var.github_config.repository
  secret_name     = "AZURE_SWA_TOKEN"
  plaintext_value = azurerm_static_web_app.main.api_key
}

# Authenticate to Azure via AzureCLI.
az login

# Initialize Terraform.
terraform init -upgrade

# Run a plan to review.
terraform plan

# Instruct Terraform to apply the configuration.
terraform apply

azurerm_static_web_app.swa: Still creating... [00m20s elapsed]
azurerm_static_web_app.swa: Creation complete after 21s [id=/subscriptions/123456-abcd-1234-abcd-1a2b3c4d5e6f/resourceGroups/abc-website-prd-rg/providers/Microsoft.Web/staticSites/abc-website-prd-app]

Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

Outputs:

swa_default_hostname = "made-up-stuff-0c260881e.1.azurestaticapps.net"
swa_deployment_token = <sensitive>

name: Deploy Hugo site to Azure Static Web Apps

on:
  push:
    branches: [ "main" ]
  pull_request:
    types: [opened, synchronize, reopened, closed]
    branches: [ "main" ]

jobs:

  build_and_deploy:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed')
    steps:
      # Checkout your repo
      - name: Checkout
        uses: actions/checkout@v4
      # Install Hugo
      # You can pin to a specific Hugo version here
      - name: Setup Hugo
        uses: peaceiris/actions-hugo@v2
        with:
          hugo-version: 'latest' # replace with latest stable if needed
          extended: true         # needed if using Hugo Pipes/SASS
      # Build the Hugo site
      - name: Build
        run: hugo -s ./src --minify
      # Deploy to Azure Static Web Apps
      - name: Deploy to Azure Static Web Apps
        uses: Azure/static-web-apps-deploy@v1
        with:
          action: upload
          azure_static_web_apps_api_token: ${{ secrets.AZURE_SWA_TOKEN }}
          # app_location is where your Hugo config.toml is
          app_location: "/src"
          # No API folder for Hugo static site
          api_location: ""
          # output_location is Hugo's public/ directory
          output_location: "public"

  close_pull_request_job:
    if: github.event_name == 'pull_request' && github.event.action == 'closed' # Close pull request, if PR was the trigger.
    runs-on: ubuntu-latest
    name: Close Pull Request Job
    steps:
      - name: Close Pull Request
        id: closepullrequest
        uses: Azure/static-web-apps-deploy@v1
        with:
          app_location: ""
          action: "close"
          azure_static_web_apps_api_token: ${{ secrets.AZURE_SWA_TOKEN }}