Azure infrastructure knowledge for HOLE Foundation (SSO backbone powering 22 service integrations via Entra ID)
Manages Azure Entra ID SSO infrastructure for 22 service integrations via Terraform.
/plugin marketplace add The-HOLE-Foundation/claude-plugins/plugin install the-hole-foundation-hole-infrastructure-hole-infrastructure@The-HOLE-Foundation/claude-pluginsThis skill inherits all available tools. When active, it can use any tool Claude has access to.
HOLE Foundation uses Azure primarily as the enterprise authentication and SSO backbone via Entra ID (Azure AD).
Terraform Workspace: azure-hole-general-services-prod
Organization: theholetruth
Location: /Volumes/HOLE-RAID-DRIVE/Projects/hole-terraformer/terraform/production/
Subscription: de602062-dafa-4c8b-91b7-98a75bcd7cff
Tenant: HOLE Foundation (holefoundation.org)
Resources: ~10 (minimal, cloud-native approach)
hole-entra-domain-services:
File: terraform/production/main.tf
Primary Function: Enterprise single sign-on for all HOLE Foundation services
22 SSO Integrations Powered:
Cloudflare (4 applications)
GitHub Enterprise
AWS IAM Identity Center
Google Cloud / G Suite (2 connectors)
Terraform Cloud
Development & Productivity (5 apps)
Additional Services (11 apps)
Total: 22 active SSO integrations
The following resources are NOT deployed (cloud-native approach, not needed):
Reason: HOLE Foundation uses cloud-native Azure AD (Entra ID), not on-premises domain services. The 22 SSO integrations work perfectly without this infrastructure.
Cost Savings: ~$50-100/month by not deploying unnecessary infrastructure
When user asks to modify Azure infrastructure:
1. Navigate to workspace:
cd /Volumes/HOLE-RAID-DRIVE/Projects/hole-terraformer/terraform/production
2. Authenticate (if needed):
az login
az account set --subscription "de602062-dafa-4c8b-91b7-98a75bcd7cff"
3. Edit Terraform files:
main.tf - Resource definitions4. Plan and apply:
terraform plan
terraform apply
No wrapper script needed - Azure uses Azure CLI authentication (no token in dotenvx)
resource "azurerm_<resource_type>" "my_resource" {
name = "my-resource"
location = azurerm_resource_group.hole_entra_domain_services.location
resource_group_name = azurerm_resource_group.hole_entra_domain_services.name
tags = {
Environment = "Production"
ManagedBy = "Terraform"
Critical = "true"
}
}
Note: Entra ID SSO integrations are typically configured via Azure Portal, not Terraform (many don't have Terraform resources yet).
Workflow:
ANY changes to Azure Entra ID can break access to all 22 services!
Before ANY Azure change:
After Azure changes, TEST these critical services:
❌ NEVER delete hole-entra-domain-services resource group
❌ NEVER delete Entra ID tenant
❌ NEVER modify Entra ID without testing plan
Deletion Impact: Would break authentication for all 22 services!
After any Azure Entra ID changes, verify these integrations work:
Tier 1 (Critical - Test Immediately):
Tier 2 (Important - Test Within 24h): 5. Google Workspace - https://workspace.google.com 6. Google Cloud Platform - https://console.cloud.google.com 7. Notion - https://notion.so 8. Perplexity AI - https://perplexity.ai
Tier 3 (Test When Needed): 9-22. Other integrated services
✅ Enterprise SSO configuration ✅ User authentication (via Entra ID) ✅ Access control across all services ✅ Identity management ✅ Group-based permissions
✅ Web hosting, DNS, CDN ✅ Application-level access control (Zero Trust)
✅ AI services, compute, storage
❌ Web hosting (use Cloudflare) ❌ DNS management (use Cloudflare) ❌ Object storage (use Cloudflare R2 or AWS S3) ❌ Serverless compute (use Cloudflare Workers or AWS Lambda)
Azure's role: Authentication backbone, not application infrastructure
✅ Deleted unused Entra Domain Services ($100/month)
✅ Removed unnecessary networking ($20/month)
✅ Kept only cloud-native Entra ID (free)
Savings: ~$120/month by optimizing to cloud-native
Cloudflare Zero Trust Access applications use Azure Entra ID for authentication:
Cloudflare Side (terraform/cloudflare/foundation/):
resource "cloudflare_access_application" "my_app" {
# ...
# Identity provider references Azure
}
Azure Side (terraform/production/):
Testing: After changes to either side, verify SSO login works
User: "Add SSO for NewService.com"
Steps:
User: "Give team member access to AWS"
Steps:
Terraform Configuration:
terraform/production/main.tf - Resource definitionsterraform/production/outputs.tf - Outputsterraform/production/backend.tf - Terraform Cloud configDocumentation:
MULTI_SUBSCRIPTION_SUMMARY.md - Azure subscription overviewSSO_INVENTORY.md - Complete SSO integration listREADME.md - Workspace documentationSubscription: de602062-dafa-4c8b-91b7-98a75bcd7cff Tenant: HOLE Foundation (holefoundation.org) Workspace: azure-hole-general-services-prod Location: terraform/production/ Resources: ~10 (minimal, optimized) SSO Integrations: 22 services Monthly Cost: ~$0 (free tier)
Authentication: Azure CLI (no token in dotenvx)
Critical: This infrastructure powers authentication for ALL services - handle with extreme care!
This skill should be used when the user asks to "create a hookify rule", "write a hook rule", "configure hookify", "add a hookify rule", or needs guidance on hookify rule syntax and patterns.
Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, or applications. Generates creative, polished code that avoids generic AI aesthetics.