Version: 1.0 | Created: 06 June 2026 | Xzopia Limited (NI620366)
This is the canonical CIPP deployment document. The Docker self-hosted approach
(docs/cipp-deployment-plan.md) was attempted in June 2026 and abandoned — see that
document and LESSONS_LEARNED.md #55–58 for why. Use Azure.
CIPP (CyberDrain Improved Partner Portal) is deployed via its official architecture:
| Component | Azure Service | Purpose |
|---|---|---|
| Frontend | Azure Static Web Apps (SWA) | Hosts Next.js React UI + managed /.auth/* endpoints |
| Backend | Azure Functions (PowerShell) | CIPP API — Graph, Partner Center, GDAP |
| Storage | Azure Storage Account | Durable Functions state, CIPP config, partner tokens |
| Secrets | Azure Key Vault | App secrets, connection strings |
| Source | GitHub fork (Silentrunnerx) | CI/CD pipeline via GitHub Actions |
Custom domain: cipp.xzopiasecure.com
Silentrunnerx (already exists)KelvinTegelaar/CIPP → Silentrunnerx/CIPPKelvinTegelaar/CIPP-API → Silentrunnerx/CIPP-APIrepo, workflow, write:packagescipp.xzopiasecure.comSilentrunnerx GitHub org, confirm or create forks:
KelvinTegelaar/CIPP → Silentrunnerx/CIPPKelvinTegelaar/CIPP-API → Silentrunnerx/CIPP-APIrepo, workflow, write:packagesrg-cipp-prodCIPP's Durable Functions require a real Azure Storage account (Azurite is not suitable — see LESSONS_LEARNED.md #56).
rg-cipp-prodxzopiacippstorage (globally unique, lowercase, no hyphens)rg-cipp-prodkv-cipp-prodrg-cipp-prodfunc-cipp-prodAzureWebJobsStorage = Storage Account connection string (Step 3)StorageConnectionString = same connection stringrg-cipp-prodswa-cipp-prodSilentrunnerx | Repository: CIPP | Branch: main/ | Output location: outSilentrunnerx/CIPP on first link.func-cipp-prod/api/* to the Function App with SWA managed auth.Silentrunnerx/CIPP-API, add GitHub repository secret AZURE_FUNCTIONAPP_PUBLISH_PROFILE:
main triggers the deploy workflow — wait for GitHub Actions to complete.cipp.xzopiasecure.comcipp → <swa-default-domain>.azurestaticapps.netcurl -I https://cipp.xzopiasecure.com → 200 with CIPP content.Note on Server 6 cert: The Let's Encrypt cert for
cipp.xzopiasecure.comon
Server 6 can be left to expire naturally once the DNS CNAME points to Azure. Renewal
will fail harmlessly (ACME HTTP challenge won't reach Server 6 anymore), then stop.
Entra admin center (https://entra.microsoft.com) → App registrations → New registration:
CIPPWeb → https://cipp.xzopiasecure.com/.auth/login/aad/callbackNote the Application (client) ID and Directory (tenant) ID.
Client secret:
CIPP Production | Expiry: 24 monthsAPI Permissions (Application permissions, grant admin consent for all):
Application.Read.All, AuditLog.Read.All, Directory.Read.All, Domain.Read.AllGroup.ReadWrite.All, GroupMember.ReadWrite.All, Mail.SendPolicy.Read.All, Reports.Read.All, RoleManagement.Read.DirectorySecurityAlert.ReadWrite.All, User.ReadWrite.AllConditional Access Policy (⛔ CE auto-fail if missing):
Require MFA for CIPPVaultwarden entry "CIPP Entra App": Client ID, Tenant ID, Client Secret Value, expiry date.
https://cipp.xzopiasecure.comServer 6 (77.68.127.221) had the self-hosted CIPP stack installed. Clean up before deploying Wazuh:
# SSH: ssh -i ~/.ssh/xzopia_server1 -p 2222 xzopia@77.68.127.221
# 1. Stop and remove CIPP Docker stack (including volumes)
cd /opt/cipp && sudo docker compose down -v && cd /
# 2. Remove CIPP files
sudo rm -rf /opt/cipp /var/www/cipp
# 3. Remove nginx vhost and reload
sudo rm /etc/nginx/conf.d/cipp.conf
sudo nginx -t && sudo systemctl reload nginx
# 4. Remove auth emulator service
sudo systemctl stop cipp-auth
sudo systemctl disable cipp-auth
sudo rm /etc/systemd/system/cipp-auth.service
sudo systemctl daemon-reload
# 5. CRITICAL: Revert AllowTcpForwarding (was set to yes during token bootstrap — must be no)
sudo sed -i 's/AllowTcpForwarding yes/AllowTcpForwarding no/' /etc/ssh/sshd_config
sudo sshd -t && sudo systemctl reload ssh
# 6. Verify no CIPP containers remain
sudo docker ps -a | grep cipp
# 7. Optionally remove the letsencrypt cert (or let it expire)
# sudo certbot delete --cert-name cipp.xzopiasecure.com
| Service | Tier | Est. Cost/month |
|---|---|---|
| Static Web App | Free | £0 |
| Function App | Consumption | ~£0–2 (low invocation volume) |
| Storage Account | LRS Standard | ~£0.50 |
| Key Vault | Standard | ~£0.10 |
| Total | ~£1–3/month |
At Xzopia's scale (70 clients, internal tool), consumption pricing is negligible.
| Resource | URL |
|---|---|
| CIPP Documentation | https://docs.cipp.app |
| CIPP SAM Prerequisites | https://docs.cipp.app/setup/installation/samapp |
| CIPP GitHub (Frontend) | https://github.com/KelvinTegelaar/CIPP |
| CIPP-API GitHub | https://github.com/KelvinTegelaar/CIPP-API |
| CIPP Discord | https://discord.gg/cyberdrain |
| Silentrunnerx GitHub Org | https://github.com/Silentrunnerx |
Xzopia Limited (NI620366) | simon@xzopia.com | Bangor, Northern Ireland