🔐 Azure Key Vault

# Key Vault Configuration Provider
dotnet add package Azure.Extensions.AspNetCore.Configuration.Secrets

# Azure Identity (für DefaultAzureCredential)
dotnet add package Azure.Identity

# Optional: Direkte Secret-Client-Nutzung
dotnet add package Azure.Security.KeyVault.Secrets

{
  "KeyVaultName": "mein-keyvault-name",
  "Logging": {
    "LogLevel": {
      "Default": "Information"
    }
  }
}

using Azure.Identity;

var builder = WebApplication.CreateBuilder(args);

// Key Vault als Configuration Provider hinzufügen
if (builder.Environment.IsProduction())
{
    builder.Configuration.AddAzureKeyVault(
        new Uri($"https://{builder.Configuration["KeyVaultName"]}.vault.azure.net/"),
        new DefaultAzureCredential());
}

// Services registrieren
builder.Services.AddControllers();

var app = builder.Build();

app.MapControllers();
app.Run();

public class MyService
{
    private readonly string _connectionString;

    public MyService(IConfiguration configuration)
    {
        // Secret-Name im Vault: "ConnectionStrings--DefaultDb"
        // Wird automatisch zu: "ConnectionStrings:DefaultDb"
        _connectionString = configuration
            .GetConnectionString("DefaultDb")!;
    }
}

// Options-Klasse definieren
public class JwtSettings
{
    public string SecretKey { get; set; } = "";
    public string Issuer { get; set; } = "";
    public int ExpiryMinutes { get; set; }
}

// In Program.cs registrieren
builder.Services.Configure<JwtSettings>(
    builder.Configuration.GetSection("Jwt"));

// Im Service per DI nutzen
public class AuthService(IOptions<JwtSettings> jwtSettings)
{
    private readonly JwtSettings _jwt = jwtSettings.Value;
}

# Key Vault erstellen
az keyvault create \
  --name mein-keyvault-name \
  --resource-group MeineRG \
  --location westeurope

# Secrets hinzufügen
az keyvault secret set \
  --vault-name mein-keyvault-name \
  --name "ConnectionStrings--DefaultDb" \
  --value "Server=tcp:myserver.database.windows.net;..."

az keyvault secret set \
  --vault-name mein-keyvault-name \
  --name "Jwt--SecretKey" \
  --value "mein-super-geheimer-jwt-key"

# App Service Managed Identity Zugriff geben
az keyvault set-policy \
  --name mein-keyvault-name \
  --object-id {APP_OBJECT_ID} \
  --secret-permissions get list

# Einmalig: Bei Azure anmelden
az login

# Optional: Key Vault auch in Development laden
# (dann if-Bedingung in Program.cs entfernen)

var builder = WebApplication.CreateBuilder(args);

// Key Vault in ALLEN Umgebungen laden
var keyVaultName = builder.Configuration["KeyVaultName"];
if (!string.IsNullOrEmpty(keyVaultName))
{
    builder.Configuration.AddAzureKeyVault(
        new Uri($"https://{keyVaultName}.vault.azure.net/"),
        new DefaultAzureCredential());
}

using Azure.Extensions.AspNetCore.Configuration.Secrets;
using Azure.Identity;

builder.Configuration.AddAzureKeyVault(
    new Uri($"https://{builder.Configuration["KeyVaultName"]}.vault.azure.net/"),
    new DefaultAzureCredential(),
    new AzureKeyVaultConfigurationOptions
    {
        // Secrets alle 5 Minuten neu laden
        ReloadInterval = TimeSpan.FromMinutes(5),

        // Optional: Nur bestimmte Secrets laden
        Manager = new KeyVaultSecretManager()
    });

// Für User-Assigned Managed Identity:
builder.Configuration.AddAzureKeyVault(
    new Uri($"https://{builder.Configuration["KeyVaultName"]}.vault.azure.net/"),
    new DefaultAzureCredential(new DefaultAzureCredentialOptions
    {
        ManagedIdentityClientId = builder.Configuration["AzureADManagedIdentityClientId"]
    }));