CR: Provision nonprod SSRS VM (vm-eshars-ssrs-np-cus)

Status: Completed Date: 2026-04-15 / 2026-04-16 Owner: Leon Risk: LOW | Duration: ~2h (including IaC build) | Rollback: destroy-rs + keep vm-sql16-np

Summary

Provisioned a new nonprod SSRS VM (vm-eshars-ssrs-np-cus) to replace the legacy vm-sql16-np (SQL Server 2016 / Windows Server 2012 R2). The new VM runs Windows Server 2022 + SQL Server 2022 Express + SSRS 2022 Express, fully automated via OpenTofu and a Custom Script Extension. It joins the existing nonprod VNet/subnet and is accessed via P2S VPN or Azure Bastion — no public IP.

Scope

Resource	Change	Environment
vm-eshars-ssrs-np-cus	Created (Windows Server 2022, Standard_D2s_v5)	nonprod
disk-eshars-ssrs-np-cus-data	Created (128 GB Premium SSD, F:)	nonprod
nic-eshars-ssrs-np-cus	Created (private IP, shared VNet/default subnet)	nonprod
nsg-eshars-ssrs-np-cus	Created (mirrors vm-sql16-np NSG pattern)	nonprod
infrastructure/report-server/	New OpenTofu root config with environments/	eshars-ops
infrastructure/modules/report-server/	New reusable module	eshars-ops

IaC Details

• Repo: eshars-ops develop branch
• State: saesharstfstate → tfstate container → report-server-nonprod.tfstate
• Module: infrastructure/modules/report-server/
• Just commands: just init-rs nonprod, just plan-rs nonprod, just apply-rs nonprod

Key design decisions

• Resource group is a data source — rg-eshars-nonprod-compute-cus is pre-existing shared infrastructure; just destroy-rs does not delete it
• SSRS installer pre-staged — SQLServerReportingServices.exe (131 MB) uploaded manually to saesharstfstate/report-server-scripts/; fwlink download URLs were unreliable
• Edition: /Edition=EXPR — The standalone SSRS 2022 installer only accepts EVAL, DEV, EXPR. ExprAdv returns exit code 87; EXPR is the correct perpetual free license
• NSG mirrors vm-sql16-np — AllowBastionRDP, AllowVpnRDP (172.16.1.0/24), AllowBuildAgentSSRS (10.1.0.12), AllowVpnSSRS, public 443 + 80

Verification

• SSRS web portal reachable at http://<private-ip>/Reports via P2S VPN
• SSRS web service reachable at http://<private-ip>/ReportServer
• SSRS Configuration Manager shows Express (not Evaluation) after /Edition=EXPR fix
• Build agent pipeline (Push-ReportDefinitions.ps1) pointed at new VM IP instead of vm-sql16-np
• vm-sql16-np decommissioned

Rollback

Trigger: SSRS unreachable or reports broken after pipeline cutover.

1. Repoint build agent pipeline back to vm-sql16-np
2. just destroy-rs nonprod to clean up new VM if needed

Outcome

Executed: 2026-04-15 — 2026-04-16 Result: Success Notes: Initial deploys iterated on subnet lookup (data source), VM name formula, NSG rules (matched vm-sql16-np), and SSRS edition flag (/Edition=EXPR — not ExprAdv). RG changed from managed resource to data source to prevent accidental deletion on destroy.