IIS Site Provisioning with SSL Binding and Health Check

id: iis-site-provisioning-with-ssl
namespace: company.team
description: |
  Provision an IIS website end to end on a Windows Server host: create the
  application pool under a dedicated identity, create the site and bind it to
  a port, optionally bind an SSL certificate already installed in the local
  certificate store, then run an HTTP health check against the new site. If
  anything fails, stop the site as a precaution and alert Slack instead of
  leaving a half-configured site accepting traffic.

inputs:
  - id: site_name
    type: STRING
    defaults: contoso-checkout
  - id: physical_path
    type: STRING
    defaults: "C:\\inetpub\\wwwroot\\contoso-checkout"
  - id: port
    type: INT
    defaults: 8443
  - id: app_pool_identity
    type: STRING
    description: Domain or virtual account the application pool runs as, for example
      a gMSA or IIS AppPool identity.
    defaults: "IIS AppPool\\contoso-checkout"
  - id: certificate_thumbprint
    type: STRING
    description: Thumbprint of an SSL certificate already installed in
      Cert:\LocalMachine\My. Leave empty to provision an HTTP-only site.
    defaults: ""
    required: false

tasks:
  - id: provision_iis_site
    type: io.kestra.plugin.scripts.powershell.Script
    description: Create the application pool and website if they do not already
      exist, then start the site.
    taskRunner:
      type: io.kestra.plugin.core.runner.Process
    script: |
      Import-Module WebAdministration -ErrorAction Stop

      $siteName = "{{ inputs.site_name }}"
      $physicalPath = "{{ inputs.physical_path }}"
      $port = {{ inputs.port }}
      $appPoolIdentity = "{{ inputs.app_pool_identity }}"

      if (-not (Test-Path $physicalPath)) {
          New-Item -Path $physicalPath -ItemType Directory -Force | Out-Null
          Write-Output "Created physical path $physicalPath."
      }

      if (Test-Path "IIS:\AppPools\$siteName") {
          Write-Output "App pool $siteName already exists, reusing it."
      } else {
          New-WebAppPool -Name $siteName | Out-Null
          Set-ItemProperty "IIS:\AppPools\$siteName" -Name processModel.identityType -Value SpecificUser
          Set-ItemProperty "IIS:\AppPools\$siteName" -Name processModel.userName -Value $appPoolIdentity
          Write-Output "Created app pool $siteName with identity $appPoolIdentity."
      }

      if (Get-Website -Name $siteName -ErrorAction SilentlyContinue) {
          Set-ItemProperty "IIS:\Sites\$siteName" -Name physicalPath -Value $physicalPath
          Write-Output "Site $siteName already exists, refreshed its physical path."
      } else {
          New-Website -Name $siteName -PhysicalPath $physicalPath -ApplicationPool $siteName -Port $port -Force | Out-Null
          Write-Output "Created site $siteName on port $port."
      }

      Start-Website -Name $siteName
      Write-Output "Site $siteName started."

  - id: bind_ssl_certificate
    type: io.kestra.plugin.core.flow.If
    description: Only touch SSL bindings when a certificate thumbprint was actually
      supplied.
    condition: "{{ inputs.certificate_thumbprint != '' }}"
    then:
      - id: apply_ssl_binding
        type: io.kestra.plugin.scripts.powershell.Commands
        description: Bind the certificate from the local machine store to the site's
          HTTPS binding using the IIS:\SslBindings provider.
        taskRunner:
          type: io.kestra.plugin.core.runner.Process
        inputFiles:
          bind-ssl.ps1: |
            Import-Module WebAdministration -ErrorAction Stop

            $siteName = "{{ inputs.site_name }}"
            $port = {{ inputs.port }}
            $thumbprint = "{{ inputs.certificate_thumbprint }}"

            if (-not (Get-WebBinding -Name $siteName -Protocol https -Port $port -ErrorAction SilentlyContinue)) {
                New-WebBinding -Name $siteName -Protocol https -Port $port -SslFlags 1
                Write-Output "Created HTTPS binding for $siteName on port $port."
            }

            $sslBindingPath = "IIS:\SslBindings\0.0.0.0!$port"
            if (-not (Test-Path $sslBindingPath)) {
                Get-Item "Cert:\LocalMachine\My\$thumbprint" | New-Item -Path $sslBindingPath | Out-Null
            }
            Write-Output "Bound certificate $thumbprint to $siteName on port $port."
        commands:
          - ./bind-ssl.ps1

  - id: health_check
    type: io.kestra.plugin.scripts.powershell.Commands
    description: Confirm the site actually answers before declaring the run a success.
    taskRunner:
      type: io.kestra.plugin.core.runner.Process
    inputFiles:
      health-check.ps1: |
        $port = {{ inputs.port }}
        $thumbprint = "{{ inputs.certificate_thumbprint }}"
        $scheme = "http"
        if ($thumbprint -ne "") {
            $scheme = "https"
        }
        $uri = "$($scheme)://localhost:$port/"

        try {
            $response = Invoke-WebRequest -Uri $uri -UseBasicParsing -TimeoutSec 15 -SkipCertificateCheck
            Write-Output "Health check succeeded for $uri with status $($response.StatusCode)."
        } catch {
            Write-Error "Health check failed for $uri : $_"
            exit 1
        }
    commands:
      - ./health-check.ps1

errors:
  - id: rollback_site
    type: io.kestra.plugin.scripts.powershell.Commands
    description: Stop the site rather than leave a half-configured binding or a
      failing health check serving traffic.
    taskRunner:
      type: io.kestra.plugin.core.runner.Process
    inputFiles:
      rollback.ps1: |
        Import-Module WebAdministration -ErrorAction Stop

        $siteName = "{{ inputs.site_name }}"
        if (Get-Website -Name $siteName -ErrorAction SilentlyContinue) {
            Stop-Website -Name $siteName
            Write-Output "Stopped $siteName after a failed provisioning run."
        }
    commands:
      - ./rollback.ps1

  - id: alert_on_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Tell the team a provisioning run failed and the site was stopped as
      a precaution.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "IIS site provisioning failed for {{ inputs.site_name }} (execution {{ execution.id }}). The site was stopped as a precaution."
      }