Installer reference

sprig infra install provisions a platform from the active operator context. It preflights the target, shows a plan, requests confirmation, and then converges the installation. sprig infra upgrade uses the same inputs to update an existing installation.

Install and upgrade

sprig infra install --prefix <prefix> --region <azure-region> \
  [--platform-vnet-cidr <cidr>] \
  [--restart] \
  [--force-entra-adoption] \
  [--yes] \
  [--domain <apps-domain> --acme-email <email> \
  [--acme-env staging|production]]

sprig infra upgrade --prefix <prefix> --region <azure-region> \
  [--platform-vnet-cidr <cidr>] \
  [--force-entra-adoption] \
  [--yes] \
  [--domain <apps-domain> --acme-email <email> \
  [--acme-env staging|production]]

Flag	Default	Meaning
--prefix <prefix>	none	Required resource-name prefix. It must be 1 to 9 lowercase letters or digits, with no hyphens.
--region <azure-region>	none	Required Azure region.
--platform-vnet-cidr <cidr>	10.240.0.0/24 for a new install	Platform VNet address space. Choose a CIDR that does not overlap with networks you intend to connect later. The value must be a canonical IPv4 CIDR.
--restart	off	Partial installs only. Ignore a completed ARM-phase checkpoint and reconcile the full ARM template again. It does not delete resources.
--yes, -y	off	Skip the final typed context-name confirmation. The resolved target and plan are still shown. Configuration drift still requires separate explicit confirmation.
--force-entra-adoption	off	Allow non-interactive adoption of a same-named Entra group or app owned by another identity. Without it, adoption requires an interactive confirmation. --yes and the general install break-glass override do not approve Entra adoption.
--domain <apps-domain>	none	Apps domain to configure with Azure DNS and Acmebot. Requires --acme-email.
--acme-email <email>	none	Contact email for certificate issuance. Requires --domain.
--acme-env <environment>	production when a domain is supplied	Certificate environment: staging for rehearsal or production for a browser-trusted certificate.

The installer creates vnet-<prefix>-platform with a dedicated delegated Container Apps subnet. Ingress remains external. This network option does not create peering, private endpoints, NAT Gateway, NSGs, firewall rules, private DNS, or an internal-only Container Apps environment.

For an existing VNet-based installation, omit --platform-vnet-cidr to reuse its live CIDR. Supplying a different CIDR is refused because the Container Apps environment network attachment cannot be changed in place.

If an install fails after the resource layer completed, run the same sprig infra install command again. The installer re-runs preflight and recomputes the plan, then continues from the Azure-backed ARM checkpoint when the checkpoint matches the requested release and the plan contains no creates or reconfiguration. Add --restart when resources changed outside the installer or when you deliberately want ARM reconciled again.

The same deployment creates a Basic sprig-platform database on the shared logical SQL server. Each platform revision runs the shipped forward-only migrations before opening its HTTP listener, so install fails if the revision cannot reach the database or bring its schema current. Successful install state records the applied metadata schema version.

The SQL metadata database starts empty on a new installation.