### TODO

- [x] Broken foreach loop
- [x] Deploy fix
- [x] Machine key not working
- [x] Fix path location
- [x] Taint null resource
- [x] Recreate VMs
- [x] Deployment Failures
- [x] APP couldn't download
- [x] Validate website and app pool created OK on VMs
- [x] Check the what DB we are pointing at
- [x] SQL User groups
- [x] SQL Admin user AD stuff
- [x] 8001 node binding logic
- [x] Investigate
- [x] Add a default Admin AD group to the MI when it is created
- [x] CAF Admins
- [x] SQL Search Button doesn't work
- [ ] Infra has a PBI for this
- [x] Policy for enforcing tags
- [ ] Jamie taking a gander
- [x] Destroy and recreate VMs for new MK
- [x] Add Machine Key check to setup script
- [x] Setup InfraTest subscription
- [ ] ADHoc Script User
- [x] Remove UKS in KV name
- [x] Remove AppGateway logging
- [ ] Merge shiptotelus to main for packer
- [x] Weekly packer image build
- [ ] Strip out Gen1 packer code
- [ ] Remove DC stuff
- [x] Deploy latest to 8001 - 8006
- [x] Set storage and kv service endpoints on Web and App subnets

### MOTODO
- [ ] provide way to create sql logins when deploying SQL mi
- [ ] fix database connection settings for Azure SQL mi in deployment engine.
- [ ] fix dacpac deployments
- [ ] fix sql script deployments
- [ ] fix issue with job checking on mi
- [ ] provide easy way to switch between two database servers. or at least let people know its an issue.
- [ ] script creation of cloudflare rules
- [ ] script creating of dpu so it matches current dpu80 setup in App gateway
- [x] Sort out terraform state storage account name for other subscriptions.
- [x] https://mbstfs2013.muddyboots.com:4443/Muddyboots%20Software%20Limited/MBS/_git/MBS-ADO-Templates/pullrequest/16475

### Questions

- What logging should the AppGateway have and how long for?
- Access logs?
- Node bindings, are they still a thing?
- The appgateway at the moment doesn't support routing to a single node
- [Link to relevant code](https://mbstfs2013.muddyboots.com:4443/Muddyboots%20Software%20Limited/MBS/_git/DevOps?path=%2FDeploymentScripts%2FDevV2%2FDEV_DeploymentLibrary.psm1&version=GBmaster&line=4623&lineEnd=4624&lineStartColumn=1&lineEndColumn=1&lineStyle=plain&_a=contents)
- Should all Devs have contributor access to QM DEV?
- We've currently added GG_Developement to QM DEV
- Is lighthouse + AAD a good idea?
- Managing access from two different places

### Actionable stuff

- [ ] Migrate Agents VMSS to TAG
- [ ] Tidy up
- [ ] Delete Hackday TF repo
- [ ] Tidy repos in general
- [ ] Clean crap out of QM-DEV Resource Group
- [ ] Make shared deployment to make as beautiful dpu deployment
- [ ] Setup Infratest subscription
- [ ] cert_keyvault_secret url must contain word `secrets` in shared
- [ ] ensure that deployment is given read over devops tooling sub
- [ ] Auto adding to PRTG
- [ ] Restores

### Actionable stuff
- [ ] SP expiry tracking
- [ ] Get the SQL MI AAD account directory.read without giving away everything
- [ ] Rewrite SQL deployment
- [ ] Allow TAG AD groups to be added to via the deployment library for DacPac deployments/restores
- [ ] Hashicorp Vault
- [ ] Reduce complexity of Terraform Plan/Apply template
- Terragrunt?!

### Bring dev into line with test

- [ ] Duplicate Infra Terraform to create a new RG, Vnet and subnets
- [ ] move to d-qm-infrastructure-uks-rg
- [ ] Old stuff needs to exist still
- [ ] going to be a new range
- [ ] Download a copy of the shared infra tfstate and delete from state
- [ ] Creating a copy basically in the new d-qm-infrastructure-uks-rg.
- [ ] APG, PIP canne be moved
- [ ] Create d-80-qm-rg manually
- [ ] Move VMs, disks, KV, Availability Set etc. manually into the new RG
- [ ] Be careful of KV permissions, they get wiped (haven't check SA)
- [ ] Basically move everything apart from the the MI and DBs
- [ ] We want to avoid the VMs/disk being deleted as that will mean that everything has to be redeployed
- [ ] Check NICs still assoicated with APG
- [ ] Update the DPU TFstate to point everything at the new RG name
- [ ] OUTAGE - Turn off VMs and make networking changes
- [ ] DNS change to new PIP
- [ ] Cloudflare LB change to new PIP
- [ ] Disassociate NICs from APG
- [ ] Give the TF a run check and it works
- [ ] Workout what to do with the SQL MI
- [ ] Cannot be migrated