8. Deployment — config, secrets, Docker, CI/CD, Azure

Configuration per environment: appsettings.json → appsettings.{Environment}.json → environment variables → Azure App Configuration / Key Vault. Bind to options classes (IOptions<T>). Never commit secrets; use User Secrets locally and Key Vault + Managed Identity in Azure.

Container image for the API:

FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
WORKDIR /src
COPY . .
RUN dotnet publish Api/Api.csproj -c Release -o /app

FROM mcr.microsoft.com/dotnet/aspnet:10.0
WORKDIR /app
COPY --from=build /app .
USER app
ENTRYPOINT ["dotnet", "Api.dll"]

Pipeline (Azure DevOps or GitHub Actions): restore → build → unit tests → publish artefact (or build/push image) → deploy to dev → automated tests → approval → staging slot → swap to production.

Hosting options: Azure App Service (simplest for a web API + SPA), Azure Container Apps (containers without managing Kubernetes), AKS (full Kubernetes), Azure Static Web Apps for the SPA. Database: Azure SQL Database. Migrations: run EF Core migration bundles or SQL scripts as a pipeline step, not on app start in production.