WebAppConnectionContainerRegistry.json

{
	"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
	"contentVersion": "1.0.0.0",
	"variables": {
		// Ensure the demo web app is unique within Azure
		"uniqueSuffix": "[tolower(uniqueString(resourceGroup().Id))]",
		"appPlanName": "[concat('demo-web-app-plan-', variables('uniqueSuffix'))]",
		"appName": "[concat('demo-web-app-', variables('uniqueSuffix'))]",

		// "Remote" Container Registry
		"registrySubscriptionId": "CHANGETO-YOUR-SUBS-GUID-000000000000",
		"registryResourceGroup": "container-registry-resource-group",
		"registryName": "hompus",
		"registryResourceId": "[resourceId(variables('registrySubscriptionId'), variables('registryResourceGroup'), 'Microsoft.ContainerRegistry/registries', variables('registryName'))]"
	},
	"resources": [
		{
			"type": "Microsoft.Web/serverfarms",
			"apiVersion": "2018-02-01",
			"name": "[variables('appPlanName')]",
			"location": "[resourceGroup().location]",
			"sku": {
				"name": "B1",
				"tier": "Basic"
			},
			"kind": "linux",
			"properties": {
				"reserved": true
			}
		},
		{
			"type": "Microsoft.Web/sites",
			"apiVersion": "2018-11-01",
			"name": "[variables('appName')]",
			"location": "[resourceGroup().location]",
			"kind": "app,linux,container",
			"properties": {
				"serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('appPlanName'))]"
			},
			"dependsOn": [
				"[resourceId('Microsoft.Web/serverfarms', variables('appPlanName'))]"
			]
		},
		{
			"type": "Microsoft.Web/sites/config",
			"apiVersion": "2018-11-01",
			"name": "[concat(variables('appName'), '/web')]",
			"properties": {
				"linuxFxVersion": "DOCKER|hompus.azurecr.io/samples/nginx:latest"
			},
			"dependsOn": [
				"[resourceId('Microsoft.Web/sites', variables('appName'))]"
			]
		},
		{
			"type": "Microsoft.Web/sites/config",
			"apiVersion": "2018-11-01",
			"name": "[concat(variables('appName'), '/appsettings')]",
			"properties": {
				"DOCKER_REGISTRY_SERVER_URL": "[reference(variables('registryResourceId'), '2019-05-01').loginServer]",
				"DOCKER_REGISTRY_SERVER_USERNAME": "[listCredentials(variables('registryResourceId'), '2019-05-01').username]",
				"DOCKER_REGISTRY_SERVER_PASSWORD": "[listCredentials(variables('registryResourceId'), '2019-05-01').passwords[0].value]",
				"WEBSITES_ENABLE_APP_SERVICE_STORAGE": "false"
			},
			"dependsOn": [
				"[resourceId('Microsoft.Web/sites', variables('appName'))]"
			]
		}
	]
}

This really came in clutch. I posted a modified version of this, which I use in an azure-pipelines.yaml template to deploy an AppService after deploying the Azure Container Registry in a separate resource group (as is recommended by Azure).

The only differences are that I pass in the resource group and name, and use the same subscriptionId; obviously in the case of multiple subscriptions you would want to pass that in as well.

I've posted it here; it works in my pipeline but I'm open to suggestions for improvement!