SonarQube on Windows with Azure SQL Database

• Code Sample
• 07/06/2022
• 2 contributors

Version 1.0

This template deploys an Azure SQL Server, Azure SQL DB, Windows Server 2012R2 VM (Standard DS1 v2) with SonarQube installed. This template can be deployed to a new resource group (recommended) or to an existing resource group.

Once the deployment is complete you can increase the resources provided to SonarQube by changing the VM from a Standard DS1 v2 machine to any larger DS_x_ v2 machine without the need to redeploy SonarQube or migrate any data.

License Third Party Notices

Note

This Beta release deploys a secure SonarQube installation by default, however we invoke a self-signed which you will have to replace with a trusted one for production use. It is not recommended to run a production server with this certificate.

Once the deployment finishes:

• Please RDP to the machine
• Download Java JDK 8 from Oracle http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html
• Install JDK (follow the wizard)
• Restart the SonarQube Service by Open “Services” and restart the server normally

Production Certificate

Because CAs provide the various SSL certificate types at different price points, you should start by deciding what type of SSL certificate to buy. To secure a single domain name (www.contoso.com), you just need a basic certificate. To secure multiple domain names (contoso.com and www.contoso.com and sonarqube.contoso.com), you need either a wildcard certificate or a certificate with Subject Alternate Name (subjectAltName).+

Once you know which SSL certificate to buy, you submit a Certificate Signing Request (CSR) to a CA. When you get requested certificate back from the CA, you then generate a .pfx file from the certificate. You can perform these steps using the tool of your choice. Here are instructions for the common tools:

• Certreq.exe steps - the Windows utility for creating certificate requests. It has been part of Windows since Windows XP/Windows Server 2000.
• IIS Manager steps - The tool of choice if you're already familiar with it.
• OpenSSL steps - an open-source, cross-platform tool. Use it to help you get an SSL certificate from any platform.
• subjectAltName steps using OpenSSL - steps for getting subjectAltName certificates.

The approach we used to secure the installation is documented in Running SonarQube behind a reversed proxy.

Workflow

This template performs the following workflow to create the SonarQube installation.

• Deploy an Azure SQL Server database (named in sqDB_ServerName) into the selected resource group
• Create a SQL database within the Azure SQL Server (named in sqDB_DBName)
• Create a Storage Acct to support the SonarQube VM
• Create a Network Service Group (firewall) which allows
  1. HTTP (port 80), HTTPS (port 443) and SonarQube (port 9000) traffic In
  2. Allows RDP (port 3389) traffic both In and Out
  3. All other Inbound traffic is blocked.
• Create a Public IP address and DNS (named in sq_PublicIP_DnsPrefix)
• Create a Virtual Network
• Create a Virtual Network Interface Card (NIC) for the SonarQube VM
• Create a Virtual Machine (named in sqVM_AppName) with Windows Server 2012 R2 and JDK8 installed
• Run a PowerShell Desired State Configuration script on the Virtual Machine to:
  1. Disable IE ESC
  2. Enable Remote Desktop
  3. Allow RDP through the Windows Firewall
  4. Allow SonarQube HTTP (80) Inbound through the Windows Firewall
  5. Allow SonarQube HTTPS (443) Inbound through the Windows Firewall
  6. Download SonarQube 5.6.1 and unzip to staging folder
  7. Replace the SonarQube connection string with the connection string of the Azure SQL Server created earlier
  8. Install SonarQube as a Windows Service using the Local Admin account
  9. Start the SonarQube Windows Service and let it configure the SonarQube DB
• In case of secure installation, run a PowerShell custom extension on the Virtual Machine to:
  1. Install Application Request Routing on IIS (ARR)
  2. Generate a self-signed certificate
  3. Change SonarQube website binding to HTTPs using port 443 and the self-signed certificate.
  4. Disable HTTP firewall rule.
  5. Configure AAR proxy settings.
  6. Add rewrite rules for the website.

Deployment

To deploy this template simply click the "Deploy to Azure" button above. This will launch the Azure Portal and you will be prompted to provide values for the parameters below.

The deployment in Azure can take up to 30 minutes. At the end of the deployment, SonarQube will be configured to run as a Windows Service on the SonarQube VM. When the SonarQube service starts for the first time, it will configure its database. This can take up to 15 minutes to complete during which time the Azure deployment shows as completed but you still won't be able to reach the SonarQube home page. Please give SonarQube some time to update.

Once the deployment and configuration have finished you will be able to access your SonarQube by entering its public address into a browser. The address format is:

http://[sq_PublicIP_DnsPrefix].[AzureRegion].cloudapp.azure.com:9000 Ex: http://my-sonarqube.eastus.cloudapp.azure.com:9000 Ex: Secure https://my-sonarqube.eastus.cloudapp.azure.com

Parameter Descriptions

Template Visualization

Tags: SonarQube, SQL, Microsoft.Resources/deployments, Microsoft.Network/virtualNetworks, Microsoft.Network/networkInterfaces, Microsoft.Compute/virtualMachines, extensions, DSC, CustomScriptExtension, Microsoft.Network/publicIPAddresses, Microsoft.Network/networkSecurityGroups, Microsoft.Sql/servers, firewallrules, databases

Contributors

We thank the following contributors to this project:

Jean-Marc Prieur,

Giulio Vian,

Brian Randell,

John Spinella,

Cesar Solis,

Sergio Romero Ortiz,

Hosam Kamel,

Kevin Mack,

Pierre Donyegro,

Rui Miguel Carriho de Melo,

David Corbin,

Gordon Beeming,

Vinicius Moura,

Clementino de Mendonca,

Steven St. Jean,

Rob Bos