# az (Azure CLI)

## What it is

Microsoft's CLI for Azure resources (`az group`, `az vm`, `az storage`,
`az iot`, ...). One login covers all Azure services.

## Install

Official Microsoft apt repo:

```bash
curl -sLS https://packages.microsoft.com/keys/microsoft.asc \
  | sudo gpg --dearmor -o /etc/apt/keyrings/microsoft.gpg
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/microsoft.gpg] \
  https://packages.microsoft.com/repos/azure-cli/ $(lsb_release -cs) main" \
  | sudo tee /etc/apt/sources.list.d/azure-cli.list
sudo apt update && sudo apt install azure-cli
```

(On arm64 use `arch=arm64`.) The one-liner `curl -sL
https://aka.ms/InstallAzureCLIDeb | sudo bash` does the same but pins less —
the explicit repo above is preferred.

## Authenticate

```bash
az login                    # browser flow
az account set --subscription <name-or-id>
```

Token cache: `~/.azure/`. For automation, create a service principal and keep
the client secret in Vaultwarden (https://vault.portugalfuturista.org):

```bash
az login --service-principal -u <app-id> -p <secret-from-vaultwarden> --tenant <tenant-id>
```

## Configure for this environment

```bash
az config set defaults.group=<resource-group> defaults.location=westeurope
az account list --output table
```

## Self-hosted equivalent

**Azurite** — the Azure Storage emulator on lattepanda
(`192.168.0.40`: blob `:10000`, queue `:10001`, table `:10002`). Point `az
storage` at it with a connection string:

```bash
export AZURE_STORAGE_CONNECTION_STRING="DefaultEndpointsProtocol=http;\
AccountName=devstoreaccount1;\
AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;\
BlobEndpoint=http://192.168.0.40:10000/devstoreaccount1;\
QueueEndpoint=http://192.168.0.40:10001/devstoreaccount1;\
TableEndpoint=http://192.168.0.40:10002/devstoreaccount1;"

az storage container create --name firmware
az storage blob upload --container-name firmware --file build.bin --name build.bin
```

(The account key above is Azurite's well-known dev key, not a secret.)
There is no emulator for non-storage Azure services — use real Azure for those.

## Aurélio integration

The **cli-azure** skill wraps `az` for resource and storage ops. Connector
registry ids: `azure` (real), `azure-azurite` (storage emulator).

## Verify

```bash
az version
# "azure-cli": "2.x.y", ...
az account show --output table
# Name  CloudName  SubscriptionId  State  IsDefault
```

## Troubleshooting

- **`az login` opens no browser** — use `az login --use-device-code` and
  complete the flow at microsoft.com/devicelogin.
- **Connection string ignored** — `az storage` flags (`--account-name`) win
  over the env var; unset conflicting flags or export
  `AZURE_STORAGE_ACCOUNT`/`AZURE_STORAGE_KEY` instead.
- **Azurite SSL errors** — Azurite here is plain HTTP; make sure the
  connection string uses `DefaultEndpointsProtocol=http`.
- **Wrong tenant** — `az account clear` then `az login --tenant <id>`.