Image-to-Deployment App

A proof-of-concept web application that turns Azure architecture diagrams into deployable Terraform configurations, runs Terraform against Azure, and produces testing/build documentation from the resulting infrastructure state.

One-liner

Upload or draw an architecture diagram, let agents interpret it into Terraform variables, deploy to Azure, and receive test/build documents — all stored with history, login, and configurable LLM settings.

High-level architecture

Frontend (React SPA)

• Login page (single-user authentication).
• Diagram upload page (PDF/image) and in-browser editor page (React Flow-style node/edge editor).
• "Run deployment" wizard showing diagram, tfvars preview, and plan/apply controls.
• LLM settings page for provider, API key, and default model selection.
• History/results view with artifact downloads (tfvars, test plan, build doc, logs).

Backend (FastAPI)

• API server exposing auth, project, diagram, generation, deployment, settings, and artifact endpoints.
• Agent Orchestrator that loads personas from agents.md, manages pipelines, and calls configured LLM models.
• Terraform Runner that writes per-run working directories and wraps terraform init/plan/apply.
• Document Generator that builds .docx test plans and build documents.

Persistence

• Relational DB (PostgreSQL or SQLite for POC) for users, projects, runs, LLM configs, and documents.
• Azure Blob Storage for diagrams, generated tfvars, Terraform logs/state, and Word documents.

Azure infrastructure

• Hosting: Azure App Service or Azure Container Apps.
• Database: Azure Database for PostgreSQL (flexible server recommended for POC simplicity).
• Storage: Azure Blob Storage (for diagrams, docs, tf artifacts).
• Identity: Managed identity or service principal for the Terraform AzureRM provider.

End-to-end flow

1. Upload/draw diagram

   • POST /api/projects/{projectId}/diagram/upload accepts PDF/image, validates, and stores in Blob Storage with DB record.
   • Diagram editor saves structured JSON via POST /api/projects/{projectId}/diagram/editor-json (preferred source for generation).

2. Generate Terraform parameters

   • POST /api/projects/{id}/generate-tfvars kicks off job.
   • Pipeline steps:
     1. Diagram Parser (vision, gpt-4o) → infra_model JSON of Azure resources/relationships.
     2. Terraform Parameter Generator (reasoning, gpt-5.1) → tfvars_json matching module schema.
     3. Terraform Validator (pro, gpt-4.1) → quality checks, corrections, warnings.
   • Renders .tfvars file to Blob Storage and marks run as ready_for_deploy.

3. Deploy with Terraform

   • POST /api/projects/{id}/deploy with run_mode (plan or apply).
   • Writes working dir (/tf-runs/{run_id}/), runs terraform init/plan/apply, captures logs/state, uploads to Blob Storage, updates run status (planned, deployed, failed).

4. Generate documents

   • After plan/apply, read Terraform state or Azure resource list.
   • Test Plan Designer (gpt-4.1/gpt-5.1) outputs structured test cases → converted to .docx test plan.
   • Build Doc Structurer (gpt-4.1) groups resources for tabular build doc → .docx file.
   • Documents stored and linked to the run.

5. History & artifacts

   • UI shows runs with statuses, tfvars JSON preview, plan/apply logs, and download links for tfvars/test-plan/build-doc.

Data model (minimal tables)

• users: id, username, password_hash, created_at.
• projects: id, name, description, created_by_user_id, created_at.
• diagrams: id, project_id, file_url, editor_json, mime_type, created_at.
• runs: id, project_id, status, infra_model_json, tfvars_json, tfvars_file_url, terraform_log_url, terraform_state_url, started_at, finished_at.
• documents: id, run_id, type (test_plan, build_doc), file_url, created_at.
• llm_configs: id, user_id, provider, api_key_encrypted, base_url, default_vision_model, default_reasoning_model, default_pro_model, created_at.
• agents: id, name, role, model, prompt_template, config_json, source.

Security & operations

• Store secrets (LLM keys, Azure credentials) in environment variables/Key Vault; encrypt API keys at rest.
• Use HTTPS, secure cookies/JWT even for single-user mode.
• Maintain audit logs per run (timestamps, artifacts). Provide a kill-switch to disable terraform apply for demo environments.

LLM defaults (editable in settings page)

• Vision: gpt-4o for diagram parsing.
• Reasoning: gpt-5.1 for Terraform and complex orchestration.
• Pro/validator: gpt-4.1 for checks, summaries, and fast responses.
• Optional: gpt-image-1-mini for future diagram generation.

Agent orchestration notes

• Agents/personas are parsed from a remote agents.md (configurable URL) into a registry.
• Pipelines:
  • diagram_to_tfvars: DiagramParser → TerraformArchitect → TerraformValidator.
  • deploy_and_docs: TerraformRunner → TestPlanWriter → BuildDocWriter.
• Inputs/outputs are stored per run; avoid logging secrets.

Frontend checklist

• Login, dashboard, project list, "New design" action.
• Diagram upload/editor pages with palette (resource group, VNet, subnet, VM, AKS, storage account, etc.).
• Run page showing diagram, tfvars preview, plan/apply actions, and status.
• Results: artifact downloads and log links.
• Settings → LLM: provider, API key (write-only), model choices, agents source + reload control.

Deployment considerations

• Package backend + frontend for Azure App Service/Container Apps; include Terraform CLI in image or sidecar.
• Use managed identity/service principal for AzureRM provider authentication.
• Prefer remote Terraform state (Azure Storage backend) for multi-run safety; fall back to local state uploaded to Blob for POC.