> ## Documentation Index
> Fetch the complete documentation index at: https://docs.certgovernance.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Connector in Azure

> Deploy certforge-connector as an Azure Container Instance inside your VNet so it can reach F5 BIG-IP, Ribbon SBCs, and other devices on private management addresses.

Deploy `certforge-connector` as an Azure Container Instance (ACI) inside your VNet so it can reach F5 BIG-IP, Ribbon SBCs, and other devices on private management addresses. No inbound firewall rules are required — the connector makes outbound calls only.

## Prerequisites

* Azure subscription with Contributor rights on the resource group
* An existing VNet that routes to the device management subnet
* NSG rule allowing TCP from the ACI subnet to the device management port (443 by default, 8443 for unlicensed F5)
* A CertForge account with admin or operator role

## Step 1 — Get your API key from CertForge

The connector authenticates with an API key tied to a named Connector Agent record.

1. In CertForge go to **Integrations → Connector Agents → Add Agent**
2. Name it something descriptive (e.g. `azure-northcentralus`) and save
3. Copy the generated key — it starts with `ct_` and is shown **once only**

## Step 2 — Prepare the subnet

ACI requires a subnet delegated exclusively to `Microsoft.ContainerInstance/containerGroups`. A dedicated subnet is cleaner than sharing one with other resources.

In the Azure Portal go to **Virtual networks → YOUR\_VNET → Subnets → + Subnet**:

| Field             | Value                                           |
| ----------------- | ----------------------------------------------- |
| Name              | `certforge-connector` (or any descriptive name) |
| Size              | `/29` — smallest valid; ACI only needs one IP   |
| Subnet delegation | `Microsoft.ContainerInstance/containerGroups`   |

<Note>A delegated subnet cannot contain other resource types (VMs, load balancers). Create a dedicated one.</Note>

## Step 3 — Create the Container Instance

In the Azure Portal go to **Container instances → + Create**.

**Basics tab**

| Field          | Value                                              |
| -------------- | -------------------------------------------------- |
| Container name | `certforge-connector`                              |
| Region         | Same region as your VNet                           |
| Image source   | Other registry                                     |
| Image          | `ghcr.io/certforge-llc/certforge-connector:latest` |
| OS type        | Linux                                              |
| Size           | 1 vCPU, 1 GiB memory                               |

**Networking tab**

| Field           | Value                                                   |
| --------------- | ------------------------------------------------------- |
| Networking type | **Private** — enables VNet integration, private IP only |
| Virtual network | Your VNet                                               |
| Subnet          | The subnet from step 2                                  |
| Ports           | Delete any pre-filled ports — no inbound ports needed   |

**Advanced tab**

Add two environment variables:

| Name                | Value                            | Secure  |
| ------------------- | -------------------------------- | ------- |
| `CERTFORGE_URL`     | `https://app.certgovernance.app` | No      |
| `CERTFORGE_API_KEY` | `ct_YOUR_KEY`                    | **Yes** |

Set **Restart policy** to `Always`.

<Tip>No config file is needed. The connector runs entirely from these two environment variables — no YAML file required.</Tip>

Click **Review + create**, then **Create**. Deployment takes about 60–90 seconds.

## Step 4 — Verify the connector is live

Once running, check the logs from the Azure CLI:

```bash theme={null}
az container logs \
  --resource-group YOUR_RG \
  --name certforge-connector \
  --follow
```

You should see the connector register its device capabilities and start polling:

```
[connector] starting v0.2.x - polling https://app.certgovernance.app every 30s
```

In CertForge, go to **Integrations → Connector Agents** — the agent should show a green *Last seen* timestamp within a minute.

<Warning>If the container keeps restarting (ExitCode 1), check the logs for an auth error. The most common cause is a typo in the API key. Delete and recreate the container with the corrected value — environment variables on a running ACI instance cannot be edited in place.</Warning>

## Step 5 — Add the device in CertForge

With the connector inside the VNet, register the device using its **private** management IP:

1. Go to **Integrations → Network Devices → Add Device**
2. Set **Type** to `f5`, `ribbon`, or the appropriate driver
3. Enter the private management IP and port
4. Enter credentials and configure TLS settings
5. Click **Query Cert** to confirm connectivity

## Azure CLI equivalent

If you prefer scripting:

```bash theme={null}
# Delegate the subnet (if not already done)
az network vnet subnet update \
  --resource-group YOUR_RG \
  --vnet-name      YOUR_VNET \
  --name           YOUR_SUBNET \
  --delegations    Microsoft.ContainerInstance/containerGroups

# Deploy the container
az container create \
  --resource-group YOUR_RG \
  --name           certforge-connector \
  --location       YOUR_REGION \
  --image          ghcr.io/certforge-llc/certforge-connector:latest \
  --vnet           YOUR_VNET \
  --subnet         YOUR_SUBNET \
  --os-type        Linux \
  --cpu 1 --memory 1 \
  --restart-policy Always \
  --environment-variables \
      CERTFORGE_URL=https://app.certgovernance.app \
  --secure-environment-variables \
      CERTFORGE_API_KEY=ct_YOUR_KEY
```

To update the container after a new release, delete and recreate it — ACI does not re-pull `:latest` on a running instance:

```bash theme={null}
az container delete --resource-group YOUR_RG --name certforge-connector --yes
# then run the create command above
```

## Environment variable reference

| Variable            | Required | Description                                                              |
| ------------------- | -------- | ------------------------------------------------------------------------ |
| `CERTFORGE_URL`     | Yes      | CertForge instance URL                                                   |
| `CERTFORGE_API_KEY` | Yes      | API key from Connector Agents. Starts with `ct_`. Mark as Secure.        |
| `CERTFORGE_POLL`    | No       | Poll interval. Default: `30s`. Accepts Go duration strings (`1m`, `2m`). |