A-Team Security — Infrastructure & Security Agent Engineer v1.1

terraform/lb.tf

@@ -0,0 +1,143 @@
+# -----------------------------------------------------------------------------
+# Self-Signed TLS Certificate (fallback when no domain)
+# -----------------------------------------------------------------------------
+resource "tls_private_key" "lb" {
+  algorithm = "RSA"
+  rsa_bits  = 2048
+}
+
+resource "tls_self_signed_cert" "lb" {
+  private_key_pem = tls_private_key.lb.private_key_pem
+
+  subject {
+    common_name  = var.domain_name != "" ? var.domain_name : "cisagent.local"
+    organization = "OCI CIS Agent"
+  }
+
+  validity_period_hours = 8760 # 1 year
+
+  allowed_uses = [
+    "key_encipherment",
+    "digital_signature",
+    "server_auth",
+  ]
+}
+
+# -----------------------------------------------------------------------------
+# Load Balancer
+# -----------------------------------------------------------------------------
+resource "oci_load_balancer_load_balancer" "main" {
+  compartment_id = var.compartment_ocid
+  display_name   = "cisagent-lb"
+  shape          = "flexible"
+  freeform_tags  = var.freeform_tags
+
+  shape_details {
+    minimum_bandwidth_in_mbps = var.lb_min_bandwidth_mbps
+    maximum_bandwidth_in_mbps = var.lb_max_bandwidth_mbps
+  }
+
+  subnet_ids = [oci_core_subnet.public.id]
+
+  is_private = false
+}
+
+# -----------------------------------------------------------------------------
+# Certificate
+# -----------------------------------------------------------------------------
+resource "oci_load_balancer_certificate" "self_signed" {
+  load_balancer_id   = oci_load_balancer_load_balancer.main.id
+  certificate_name   = "cisagent-self-signed"
+  public_certificate = tls_self_signed_cert.lb.cert_pem
+  private_key        = tls_private_key.lb.private_key_pem
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+# -----------------------------------------------------------------------------
+# Backend Set
+# -----------------------------------------------------------------------------
+resource "oci_load_balancer_backend_set" "app" {
+  load_balancer_id = oci_load_balancer_load_balancer.main.id
+  name             = "cisagent-backend-set"
+  policy           = "ROUND_ROBIN"
+
+  health_checker {
+    protocol            = "HTTP"
+    port                = 8080
+    url_path            = "/api/health"
+    interval_ms         = 10000
+    timeout_in_millis   = 5000
+    retries             = 3
+    return_code         = 200
+  }
+}
+
+# -----------------------------------------------------------------------------
+# Backend
+# -----------------------------------------------------------------------------
+resource "oci_load_balancer_backend" "app" {
+  load_balancer_id = oci_load_balancer_load_balancer.main.id
+  backendset_name  = oci_load_balancer_backend_set.app.name
+  ip_address       = oci_core_instance.app.private_ip
+  port             = 8080
+}
+
+# -----------------------------------------------------------------------------
+# HTTPS Listener (443)
+# -----------------------------------------------------------------------------
+resource "oci_load_balancer_listener" "https" {
+  load_balancer_id         = oci_load_balancer_load_balancer.main.id
+  name                     = "cisagent-https-listener"
+  default_backend_set_name = oci_load_balancer_backend_set.app.name
+  port                     = 443
+  protocol                 = "HTTP"
+
+  ssl_configuration {
+    certificate_name        = oci_load_balancer_certificate.self_signed.certificate_name
+    verify_peer_certificate = false
+    protocols               = ["TLSv1.2", "TLSv1.3"]
+  }
+}
+
+# -----------------------------------------------------------------------------
+# HTTP → HTTPS Redirect Rule Set
+# -----------------------------------------------------------------------------
+resource "oci_load_balancer_rule_set" "redirect_http_to_https" {
+  load_balancer_id = oci_load_balancer_load_balancer.main.id
+  name             = "redirect-http-to-https"
+
+  items {
+    action = "REDIRECT"
+
+    conditions {
+      attribute_name  = "PATH"
+      attribute_value = "/"
+      operator        = "FORCE_LONGEST_PREFIX_MATCH"
+    }
+
+    redirect_uri {
+      protocol = "HTTPS"
+      port     = 443
+      host     = "{host}"
+      path     = "/{path}"
+      query    = "?{query}"
+    }
+
+    response_code = 301
+  }
+}
+
+# -----------------------------------------------------------------------------
+# HTTP Listener (80) with Redirect
+# -----------------------------------------------------------------------------
+resource "oci_load_balancer_listener" "http" {
+  load_balancer_id         = oci_load_balancer_load_balancer.main.id
+  name                     = "cisagent-http-listener"
+  default_backend_set_name = oci_load_balancer_backend_set.app.name
+  port                     = 80
+  protocol                 = "HTTP"
+  rule_set_names           = [oci_load_balancer_rule_set.redirect_http_to_https.name]
+}