Modernize templates, fix cloud-init provisioning race, reorganize repo and rewrite docs

.gitattributes

@@ -0,0 +1,18 @@
+# Normalize line endings on commit for text files.
+* text=auto
+
+# Scripts executed on Linux VMs (via Custom Script Extension / cloud-init) must
+# always be checked out with LF endings. CRLF causes the shebang to fail with
+# "bad interpreter: No such file or directory".
+*.sh    text eol=lf
+*.azcli text eol=lf
+cloud-init.txt text eol=lf
+
+# Windows scripts keep CRLF.
+*.ps1 text eol=crlf
+
+# Templates and docs.
+*.bicep text eol=lf
+*.json  text eol=lf
+*.md    text eol=lf
+*.yml   text eol=lf

.github/workflows/validate-templates.yml

@@ -0,0 +1,63 @@
+name: Validate templates
+
+on:
+  push:
+    branches: [master]
+    paths: ['infra/**', 'scripts/**', '.github/workflows/validate-templates.yml']
+  pull_request:
+    paths: ['infra/**', 'scripts/**', '.github/workflows/validate-templates.yml']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  bicep:
+    name: Build, lint and check ARM output is in sync
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Bicep CLI
+        run: |
+          curl -sLo bicep https://github.com/Azure/bicep/releases/latest/download/bicep-linux-x64
+          chmod +x bicep && sudo mv bicep /usr/local/bin/bicep
+          bicep --version
+
+      - name: Lint Bicep sources
+        run: |
+          for src in infra/bicep/*.bicep; do
+            echo "Linting $src"
+            bicep lint "$src"
+          done
+
+      # The ARM JSON under infra/arm/ is generated, never hand-edited. Rebuild it
+      # and fail if the result differs from what is committed.
+      - name: Rebuild ARM templates and verify they match the committed output
+        run: |
+          for src in infra/bicep/*.bicep; do
+            out="infra/arm/$(basename "${src%.bicep}").json"
+            bicep build "$src" --outfile "$out"
+          done
+          if ! git diff --exit-code -- infra/arm; then
+            echo "::error::infra/arm/*.json is out of sync with infra/bicep/*.bicep. Run 'az bicep build' and commit the result."
+            exit 1
+          fi
+
+  shell:
+    name: Shell script syntax and line endings
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # CRLF in a script executed by the Custom Script Extension breaks the
+      # shebang with "bad interpreter: No such file or directory".
+      - name: Reject CRLF line endings
+        run: |
+          if grep -rlU $'\r' scripts/linux labs; then
+            echo "::error::Files above contain CRLF line endings; they must be LF."
+            exit 1
+          fi
+
+      - name: Check syntax
+        run: for f in scripts/linux/*.sh; do bash -n "$f"; done

notes.txt → docs/notes.md

@@ -7,6 +7,6 @@ az vm create \
     --custom-data cloud-init.txt
 
 
-az network public-ip create --name $spoke1name-vm-pip --resource-group $rg --location $vhub1location --allocation-method Dynamic --output none
+az network public-ip create --name $spoke1name-vm-pip --resource-group $rg --location $vhub1location --allocation-method Static --sku Standard --output none
 az network nic create --resource-group $rg -n $spoke1name-vm-nic --location $vhub1location --subnet vmsubnet --vnet-name $spoke1name-vnet --public-ip-address $spoke1name-vm-pip  --output none
 az vm create -n $spoke1name-vm -g $rg --image Ubuntu2404 --size Standard_B1s --admin-username $username --admin-password $password --nics $spoke1name-vm-nic --no-wait --location $vhub1location  --output none

LinuxRouter-newsubnet.json → infra/arm/linux-router-newsubnet.json

@@ -4,8 +4,8 @@
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.44.1.10279",
-      "templateHash": "8094453408631886471"
+      "version": "0.46.1.21595",
+      "templateHash": "2884941074303245104"
     }
   },
   "parameters": {
@@ -78,7 +78,7 @@
     },
     "scriptUri": {
       "type": "string",
-      "defaultValue": "[uri(deployment().properties.templateLink.uri, 'linuxrouter.sh')]",
+      "defaultValue": "[uri(deployment().properties.templateLink.uri, '../../scripts/linux/linuxrouter.sh')]",
       "metadata": {
         "description": "Script that will be executed"
       }
@@ -103,12 +103,20 @@
       "metadata": {
         "description": "Deploy Public IP Address"
       }
+    },
+    "allowSshFromAddressPrefix": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Source address prefix allowed to reach the VM on TCP 22, for example 203.0.113.4/32. Standard SKU public IPs deny inbound traffic by default, so leave this empty only if you do not need SSH from the internet. Use Internet to allow any source (not recommended)."
+      }
     }
   },
   "variables": {
     "extensionName": "CustomScript",
     "nicName": "[format('{0}-NIC', parameters('virtualMachineName'))]",
     "publicIPAddressName": "[format('{0}-PublicIP', parameters('virtualMachineName'))]",
+    "sshSecurityRules": "[if(empty(parameters('allowSshFromAddressPrefix')), createArray(), createArray(createObject('name', 'Allow-SSH-Inbound', 'properties', createObject('priority', 200, 'protocol', 'Tcp', 'access', 'Allow', 'direction', 'Inbound', 'sourceAddressPrefix', parameters('allowSshFromAddressPrefix'), 'sourcePortRange', '*', 'destinationAddressPrefix', '*', 'destinationPortRange', '22'))))]",
     "osVersionDefinitions": {
       "22.04": {
         "publisher": "Canonical",
@@ -131,25 +139,7 @@
       "name": "default-nsg",
       "location": "[parameters('location')]",
       "properties": {
-        "securityRules": [
-          {
-            "name": "Allow-Traffic-RFC-1918",
-            "properties": {
-              "priority": 300,
-              "protocol": "*",
-              "access": "Allow",
-              "direction": "Inbound",
-              "sourceAddressPrefixes": [
-                "10.0.0.0/8",
-                "172.16.0.0/12",
-                "192.168.0.0/16"
-              ],
-              "sourcePortRange": "*",
-              "destinationAddressPrefix": "*",
-              "destinationPortRange": "*"
-            }
-          }
-        ]
+        "securityRules": "[concat(variables('sshSecurityRules'), createArray(createObject('name', 'Allow-Traffic-RFC-1918', 'properties', createObject('priority', 300, 'protocol', '*', 'access', 'Allow', 'direction', 'Inbound', 'sourceAddressPrefixes', createArray('10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16'), 'sourcePortRange', '*', 'destinationAddressPrefix', '*', 'destinationPortRange', '*'))))]"
       }
     },
     {