refactor: single container image only, update terraform and docs
- Remove two-container compose from distribution - Single docker-compose.yml using unified OCIR image - Update cloud-init template for single container - README with 4 deployment options: local Docker, OCI VM (Terraform), Container Instances, Kubernetes
This commit is contained in:
nogueiraguh
@@ -94,54 +94,38 @@ Distributed as pre-built Docker containers via **Oracle Container Registry (OCIR
|
||||
|
||||
---
|
||||
|
||||
## Quick Start
|
||||
## Deployment Options
|
||||
|
||||
### Prerequisites
|
||||
The platform is distributed as a single Docker image available on **Oracle Container Registry (OCIR)**:
|
||||
|
||||
- Docker and Docker Compose v2
|
||||
- Access to the OCI Container Registry (OCIR)
|
||||
```
|
||||
us-ashburn-1.ocir.io/idi1o0a010nx/oci-cis-agent:latest
|
||||
```
|
||||
|
||||
### 1. Configure
|
||||
Multi-architecture: `linux/amd64` + `linux/arm64`
|
||||
|
||||
---
|
||||
|
||||
### Option 1 — Local Docker (any machine)
|
||||
|
||||
Run on any machine with Docker installed (Linux, macOS, Windows).
|
||||
|
||||
```bash
|
||||
# 1. Login to OCIR
|
||||
docker login us-ashburn-1.ocir.io
|
||||
|
||||
# 2. Configure
|
||||
cp .env.example .env
|
||||
```
|
||||
# Edit .env: set APP_SECRET (openssl rand -hex 64)
|
||||
|
||||
Edit `.env`:
|
||||
```env
|
||||
OCIR_REGION=us-ashburn-1
|
||||
OCIR_NAMESPACE=your_namespace
|
||||
APP_SECRET=<generate with: openssl rand -hex 64>
|
||||
```
|
||||
|
||||
### 2. Login to OCIR
|
||||
|
||||
```bash
|
||||
docker login <OCIR_REGION>.ocir.io
|
||||
```
|
||||
|
||||
- **Username:** `<namespace>/<username>` or `<namespace>/oracleidentitycloudservice/<email>`
|
||||
- **Password:** Auth Token (generate in OCI Console > Profile > Auth Tokens)
|
||||
|
||||
### 3. Run
|
||||
|
||||
**Option A — Single Container** (recommended for simplicity):
|
||||
|
||||
```bash
|
||||
docker compose -f docker-compose.single.yml up -d
|
||||
```
|
||||
|
||||
One container runs everything (nginx + backend). Port `8080`.
|
||||
|
||||
**Option B — Two Containers** (recommended for production):
|
||||
|
||||
```bash
|
||||
# 3. Run
|
||||
docker compose up -d
|
||||
|
||||
# 4. Access: http://localhost:8080
|
||||
docker logs oci-cis-agent | grep "password"
|
||||
```
|
||||
|
||||
Separate backend and frontend containers with internal networking.
|
||||
|
||||
**Option C — Docker Run** (no compose needed):
|
||||
Or with `docker run` (no compose file needed):
|
||||
|
||||
```bash
|
||||
docker run -d \
|
||||
@@ -150,32 +134,16 @@ docker run -d \
|
||||
-v agent-data:/data \
|
||||
-e APP_SECRET=$(openssl rand -hex 64) \
|
||||
-e TZ=America/Sao_Paulo \
|
||||
<OCIR_REGION>.ocir.io/<OCIR_NAMESPACE>/oci-cis-agent:latest
|
||||
us-ashburn-1.ocir.io/idi1o0a010nx/oci-cis-agent:latest
|
||||
```
|
||||
|
||||
### 4. Access
|
||||
|
||||
Open `http://localhost:8080`
|
||||
|
||||
The initial admin password is generated automatically and displayed in the container logs:
|
||||
|
||||
```bash
|
||||
# Single container / docker run
|
||||
docker logs oci-cis-agent | grep "password"
|
||||
|
||||
# Two containers
|
||||
docker compose logs backend | grep "password"
|
||||
```
|
||||
|
||||
> You will be prompted to change the password on first login.
|
||||
|
||||
---
|
||||
|
||||
## Deploy on OCI (Terraform)
|
||||
### Option 2 — OCI Compute Instance (Terraform)
|
||||
|
||||
For production deployment on Oracle Cloud Infrastructure with Load Balancer, WAF, and SSL.
|
||||
Production deployment on Oracle Cloud with Load Balancer, WAF, SSL, and persistent storage.
|
||||
|
||||
### Architecture
|
||||
**Architecture:**
|
||||
|
||||
```
|
||||
+--------------------------------------------------------------+
|
||||
@@ -189,25 +157,24 @@ For production deployment on Oracle Cloud Infrastructure with Load Balancer, WAF
|
||||
| | | | Compute Instance | | |
|
||||
| +-----------------+ | | (ARM, Free Tier eligible) | | |
|
||||
| | | | | | | |
|
||||
| | Load Balancer |---->| | Backend (FastAPI :8000) | | |
|
||||
| | (HTTPS / 443) | | | Frontend (nginx :80) | | |
|
||||
| | Public Subnet | | | Block Volume (/data) | | |
|
||||
| | Load Balancer |---->| | oci-cis-agent container | | |
|
||||
| | (HTTPS / 443) | | | Block Volume (/data) | | |
|
||||
| | Public Subnet | | | | | |
|
||||
| | | | +---------------------------+ | |
|
||||
| +-----------------+ +--------------------------------+ |
|
||||
| |
|
||||
+--------------------------------------------------------------+
|
||||
```
|
||||
|
||||
### Setup
|
||||
**Setup:**
|
||||
|
||||
```bash
|
||||
cd terraform
|
||||
cp terraform.tfvars.example terraform.tfvars
|
||||
# Edit terraform.tfvars with OCI credentials
|
||||
```
|
||||
|
||||
Edit `terraform.tfvars` with your OCI credentials and configuration.
|
||||
|
||||
### Deploy
|
||||
**Deploy:**
|
||||
|
||||
```bash
|
||||
terraform init
|
||||
@@ -215,7 +182,7 @@ terraform plan
|
||||
terraform apply
|
||||
```
|
||||
|
||||
### Resources Created
|
||||
**Resources Created:**
|
||||
|
||||
| Resource | Description |
|
||||
|----------|-------------|
|
||||
@@ -224,22 +191,119 @@ terraform apply
|
||||
| Block Volume | 50GB persistent storage for application data |
|
||||
| Load Balancer | Flexible 10-100 Mbps with SSL (self-signed or Let's Encrypt) |
|
||||
| WAF | OWASP protection — XSS, SQL injection, path traversal + rate limiting |
|
||||
| OCIR | 2 private container repositories (backend + frontend) |
|
||||
| DNS | OCI DNS Zone + A record (conditional — when domain is configured) |
|
||||
|
||||
### Outputs
|
||||
|
||||
After `terraform apply`:
|
||||
**Outputs:**
|
||||
|
||||
```bash
|
||||
terraform output load_balancer_ip # Public IP address
|
||||
terraform output app_url # Application URL
|
||||
terraform output ocir_backend_url # Backend image URL
|
||||
terraform output ocir_frontend_url # Frontend image URL
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Option 3 — OCI Container Instances
|
||||
|
||||
Run as a serverless container on OCI without managing VMs.
|
||||
|
||||
```bash
|
||||
oci container-instances container-instance create \
|
||||
--compartment-id <COMPARTMENT_OCID> \
|
||||
--display-name "oci-cis-agent" \
|
||||
--availability-domain <AD> \
|
||||
--shape "CI.Standard.E4.Flex" \
|
||||
--shape-config '{"ocpus": 2, "memoryInGBs": 16}' \
|
||||
--containers '[{
|
||||
"imageUrl": "us-ashburn-1.ocir.io/idi1o0a010nx/oci-cis-agent:latest",
|
||||
"displayName": "agent",
|
||||
"environmentVariables": {
|
||||
"APP_SECRET": "<YOUR_SECRET>",
|
||||
"TZ": "America/Sao_Paulo"
|
||||
}
|
||||
}]' \
|
||||
--vnics '[{"subnetId": "<SUBNET_OCID>"}]' \
|
||||
--image-pull-secrets '[{"registryEndpoint": "us-ashburn-1.ocir.io", "secretType": "BASIC", "username": "<OCIR_USER>", "password": "<AUTH_TOKEN>"}]'
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### Option 4 — Kubernetes (OKE / any K8s cluster)
|
||||
|
||||
Deploy on Oracle Kubernetes Engine or any Kubernetes cluster.
|
||||
|
||||
```yaml
|
||||
# Minimal deployment
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: oci-cis-agent
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: oci-cis-agent
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: oci-cis-agent
|
||||
spec:
|
||||
containers:
|
||||
- name: agent
|
||||
image: us-ashburn-1.ocir.io/idi1o0a010nx/oci-cis-agent:latest
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
env:
|
||||
- name: APP_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: agent-secret
|
||||
key: app-secret
|
||||
- name: TZ
|
||||
value: "America/Sao_Paulo"
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
memory: "2Gi"
|
||||
limits:
|
||||
memory: "4Gi"
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: agent-data
|
||||
imagePullSecrets:
|
||||
- name: ocir-credentials
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: oci-cis-agent
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
ports:
|
||||
- port: 443
|
||||
targetPort: 8080
|
||||
selector:
|
||||
app: oci-cis-agent
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### First Login
|
||||
|
||||
After any deployment option, check the container logs for the initial admin password:
|
||||
|
||||
```bash
|
||||
docker logs oci-cis-agent | grep "password"
|
||||
# or
|
||||
kubectl logs deployment/oci-cis-agent | grep "password"
|
||||
```
|
||||
|
||||
> You will be prompted to change the password on first login.
|
||||
|
||||
---
|
||||
|
||||
## Configuration Guide
|
||||
|
||||
### Step 1 — OCI Credentials
|
||||
|
||||
Reference in New Issue
Block a user