A-Team Security — Infrastructure & Security Agent Engineer v1.1

terraform/compute.tf

@@ -0,0 +1,78 @@
+# -----------------------------------------------------------------------------
+# Data Sources
+# -----------------------------------------------------------------------------
+data "oci_identity_availability_domains" "ads" {
+  compartment_id = var.tenancy_ocid
+}
+
+data "oci_core_images" "oracle_linux_8" {
+  compartment_id           = var.compartment_ocid
+  operating_system         = "Oracle Linux"
+  operating_system_version = "8"
+  shape                    = var.instance_shape
+  sort_by                  = "TIMECREATED"
+  sort_order               = "DESC"
+
+  filter {
+    name   = "display_name"
+    values = ["^Oracle-Linux-8\\..*-aarch64-.*$"]
+    regex  = true
+  }
+}
+
+# -----------------------------------------------------------------------------
+# Compute Instance
+# -----------------------------------------------------------------------------
+resource "oci_core_instance" "app" {
+  compartment_id      = var.compartment_ocid
+  availability_domain = data.oci_identity_availability_domains.ads.availability_domains[0].name
+  display_name        = "cisagent-vm"
+  shape               = var.instance_shape
+  freeform_tags       = var.freeform_tags
+
+  shape_config {
+    ocpus         = var.instance_ocpus
+    memory_in_gbs = var.instance_memory_gb
+  }
+
+  source_details {
+    source_type = "image"
+    source_id   = data.oci_core_images.oracle_linux_8.images[0].id
+  }
+
+  create_vnic_details {
+    subnet_id        = oci_core_subnet.private.id
+    assign_public_ip = false
+    display_name     = "cisagent-vnic"
+    hostname_label   = "cisagent"
+  }
+
+  metadata = {
+    ssh_authorized_keys = var.ssh_public_key
+    user_data = base64encode(templatefile("${path.module}/templates/cloud-init.sh.tpl", {
+      ocir_region     = var.region
+      ocir_namespace  = var.ocir_namespace
+      ocir_username   = var.ocir_username
+      ocir_auth_token = var.ocir_auth_token
+      ocir_repo_prefix = var.ocir_repo_prefix
+      app_secret      = var.app_secret
+      jwt_expiry_hours = var.jwt_expiry_hours
+      app_timezone    = var.app_timezone
+      cors_origins    = var.domain_name != "" ? "https://${var.domain_name}" : "*"
+      data_device     = "/dev/oracleoci/oraclevdb"
+    }))
+  }
+
+  agent_config {
+    is_monitoring_disabled  = false
+    is_management_disabled  = false
+    are_all_plugins_disabled = false
+  }
+
+  lifecycle {
+    ignore_changes = [
+      source_details[0].source_id,
+      metadata["user_data"],
+    ]
+  }
+}