The Azure Estate
One Pulumi program, one environment, every logical name prefixed plutus-. Half of it is running. The other half is code that waits for a gate.
Two halves of one program
Plutus.Pulumi.Infrastructure.Prod/Program.cs describes the whole estate, but it stands up in two steps behind a single flag. With deployEstate=false — the default, and the current stack configuration — only the foundation exists: a resource group, a storage account, one container, and a data-plane role for whoever ran pulumi up. Flipping the flag at Phase 4 adds everything else without touching what is already there.
The foundation was deployed on 2026-09-01, the same evening the news archiver first wrote to it. Nothing in the estate half has been stood up. That is deliberate — the rule is to deploy when a gate requires it — and this page describes the estate as designed, not as running.
The foundation — deployed
2026-09-01| Resource | Name | Settings that matter |
|---|---|---|
| Resource group | plutus-prod-rg | Central US; tagged Production |
| Storage account | plutusprodblob | StorageV2, Standard_ZRS, hot tier, TLS 1.2 minimum, no public blob access |
| Blob service | — | Versioning on; 14-day soft delete |
| Container | plutus-artifacts | The one container — the path is the index, more containers buy nothing |
| Role assignment | Storage Blob Data Contributor | Granted to the deployer's own identity, scoped to the account |
Versioning and soft delete are there because the archive's whole value is that it is never lost; an accidental overwrite or delete is recoverable for two weeks. The role assignment is what lets the archiver run on a laptop with DefaultAzureCredential and no connection string. The VM's managed identity gets the same role when the estate arrives.
The estate — coded, waiting for Phase 4
not deployedA virtual network at 10.2.0.0/16 — chosen so it cannot collide with GMI's 10.1.0.0/16 if anyone ever needs the two to talk — with five /24 subnets:
| Subnet | Prefix | Delegated to |
|---|---|---|
plutus-prod-admin-app-subnet | 10.2.0.0/24 | App Service |
plutus-prod-technology-app-subnet | 10.2.1.0/24 | App Service |
plutus-prod-function-app-subnet | 10.2.2.0/24 | App Service (functions) |
plutus-prod-mysql-subnet | 10.2.3.0/24 | MySQL Flexible Server |
plutus-prod-vm-subnet | 10.2.4.0/24 | — (the trader VM) |
- Trader VM
plutus-prod-trader-vm— Standard_B2s (2 vCPU, 4 GB), Ubuntu 22.04, system-assigned identity, SSH key only with password auth disabled, inbound 22 from one configured IP and the Azure DevOps range. A custom-script extension installs the .NET 10 runtime and lays out/opt/plutus. - Two App Service plans, both B1 Linux —
plutus-prod-aspfor the two SSR sites,plutus-prod-function-aspfor the API, split to avoid VNet connection limits. - Three web apps —
plutus-prod-admin-webapp,plutus-prod-technology-webapp(this site),plutus-prod-functions; each with a managed identity and VNet routing. - MySQL Flexible Server
plutus-prod-mysql— Standard_B1ms burstable, 32 GB, version 8.0.21, public network access disabled, 35-day backups, databaseplutusproddbin utf8mb4. - Key Vault
plutus-prod-kv— Standard, soft delete for 90 days, purge protection on; the deployer can manage secrets, every workload identity can only get and list.
What it costs, and what it would cost elsewhere
| Line | $/month |
|---|---|
| Trader VM + OS disk | ~36 |
| Two App Service plans (B1) | ~26 |
| MySQL B1ms + 32 GB + backups | ~17–22 |
| Storage, Key Vault, public IP, bandwidth | ~9–12 |
| Azure subtotal | ~90–100 |
| Claude, FMP, Twilio, IBKR data — cloud-agnostic | ~30–100 |
| All-in at launch scale | ~120–200 |
The same capability was priced on AWS (~$68) and GCP (~$63–70). Most of the gap is one line: two always-on B1 plans against scale-to-zero hosting. That was kept on purpose, on 2026-08-27 — a visitor to this site should never wait on a cold start, and ~$20 a month is what that costs. Migration payback was estimated at years or never. Today's bill, with only the foundation running, is a few dollars.
- Prod only. No dev or staging environment, decided 2026-08-24 — roughly half the bill of a split
- Every name starts
plutus-(storage accounts drop the hyphen:plutusprodblob) - Identity over secrets — every compute resource has a system-assigned identity
- No password auth anywhere a key or an identity can do the job