From 06c3c1ec93bb1cb7b8ff7f51dbb445d8a01a4ad4 Mon Sep 17 00:00:00 2001
From: Oliver Kieselbach <oliver.kieselbach@outlook.com>
Date: Sun, 5 Apr 2026 12:58:22 +0200
Subject: [PATCH] updated container bicep

---
 infra/mcp-server.bicep | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/infra/mcp-server.bicep b/infra/mcp-server.bicep
index da8a5e68..9676596e 100644
--- a/infra/mcp-server.bicep
+++ b/infra/mcp-server.bicep
@@ -4,7 +4,8 @@
 //   az deployment group create \
 //     --resource-group <rg-name> \
 //     --template-file infra/mcp-server.bicep \
-//     --parameters apiUrl=https://autopilotmonitor-api.azurewebsites.net
+//     --parameters apiUrl=https://autopilotmonitor-api.azurewebsites.net \
+//                  entraClientSecret=<secret-value>
 
 @description('Azure region for all resources')
 param location string = resourceGroup().location
@@ -27,6 +28,10 @@ param apiUrl string = 'https://autopilotmonitor-api.azurewebsites.net'
 @description('Container image tag')
 param imageTag string = 'latest'
 
+@secure()
+@description('Entra ID client secret for OAuth token exchange')
+param entraClientSecret string = ''
+
 // --- Azure Container Registry ---
 
 resource acr 'Microsoft.ContainerRegistry/registries@2023-07-01' = {
@@ -95,6 +100,10 @@ resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
           name: 'acr-password'
           value: acr.listCredentials().passwords[0].value
         }
+        {
+          name: 'entra-client-secret'
+          value: entraClientSecret
+        }
       ]
       activeRevisionsMode: 'Single'
     }
@@ -110,7 +119,7 @@ resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
           env: [
             { name: 'AUTOPILOT_API_URL', value: apiUrl }
             { name: 'PORT', value: '8080' }
-            { name: 'SEARCH_BACKEND', value: 'vector' }
+            { name: 'AUTOPILOT_ENTRA_CLIENT_SECRET', secretRef: 'entra-client-secret' }
           ]
           probes: [
             {