feat: OCI deployment — Terraform VM + OKE stacks, OCIR, K8s manifests

- terraform-vm/: ARM VM (A1.Flex Free Tier), Docker Compose, Block Volume, LB+WAF+SSL
- terraform-oke/: OKE cluster (3 nodes Intel), NodePort, LB+WAF+SSL
- k8s/: namespace, deployments, services, PVC, secrets, configmap
- Dockerfile.frontend: self-contained nginx+dist image
- push-images.sh: multi-arch build (amd64+arm64) + push to OCIR
- dns.tf: conditional OCI DNS Zone + A record (when domain available)
- Both stacks 100% independent, no shared modules
- .gitignore: terraform state, .terraform/, *.tfvars

deploy/k8s/configmap.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: oci-cis-agent-config
+  namespace: oci-cis-agent
+data:
+  JWT_EXPIRY_HOURS: "12"
+  TZ: "America/Sao_Paulo"
+  DATA_DIR: "/data"
+  CORS_ORIGINS: "https://LOAD_BALANCER_IP"
+  OCI_CLI_SUPPRESS_FILE_PERMISSIONS_WARNING: "True"

deploy/k8s/deployment.yaml

@@ -0,0 +1,111 @@
+##
+## Backend — FastAPI (port 8000)
+##
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: oci-cis-agent
+  labels:
+    app: oci-cis-agent-backend
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: oci-cis-agent-backend
+  template:
+    metadata:
+      labels:
+        app: oci-cis-agent-backend
+    spec:
+      imagePullSecrets:
+        - name: ocir-credentials
+      containers:
+        - name: backend
+          image: OCIR_REGION.ocir.io/OCIR_NAMESPACE/oci-cis-agent-backend:latest
+          ports:
+            - containerPort: 8000
+          envFrom:
+            - configMapRef:
+                name: oci-cis-agent-config
+          env:
+            - name: APP_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: app-secret
+                  key: APP_SECRET
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          resources:
+            requests:
+              memory: "2Gi"
+              cpu: "500m"
+            limits:
+              memory: "4Gi"
+              cpu: "2000m"
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: 8000
+            initialDelaySeconds: 30
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: 8000
+            initialDelaySeconds: 60
+            periodSeconds: 30
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: oci-cis-agent-data
+
+---
+
+##
+## Frontend — nginx (port 80)
+##
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontend
+  namespace: oci-cis-agent
+  labels:
+    app: oci-cis-agent-frontend
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: oci-cis-agent-frontend
+  template:
+    metadata:
+      labels:
+        app: oci-cis-agent-frontend
+    spec:
+      imagePullSecrets:
+        - name: ocir-credentials
+      containers:
+        - name: frontend
+          image: OCIR_REGION.ocir.io/OCIR_NAMESPACE/oci-cis-agent-frontend:latest
+          ports:
+            - containerPort: 80
+          env:
+            - name: TZ
+              valueFrom:
+                configMapKeyRef:
+                  name: oci-cis-agent-config
+                  key: TZ
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 5
+            periodSeconds: 10

deploy/k8s/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: oci-cis-agent
+  labels:
+    app.kubernetes.io/part-of: oci-cis-agent

deploy/k8s/pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: oci-cis-agent-data
+  namespace: oci-cis-agent
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: oci-bv
+  resources:
+    requests:
+      storage: 50Gi

deploy/k8s/secret.yaml

@@ -0,0 +1,35 @@
+##
+## Fill in the placeholder values before applying.
+##
+## APP_SECRET: generate with  python -c "import secrets; print(secrets.token_hex(64))"
+##             then base64-encode it:  echo -n '<value>' | base64
+##
+## OCIR dockerconfigjson:
+##   kubectl create secret docker-registry ocir-credentials \
+##     --namespace oci-cis-agent \
+##     --docker-server=OCIR_REGION.ocir.io \
+##     --docker-username='OCIR_NAMESPACE/USERNAME' \
+##     --docker-password='AUTH_TOKEN' \
+##     --dry-run=client -o yaml
+##   Copy the .data[.dockerconfigjson] value below.
+##
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: app-secret
+  namespace: oci-cis-agent
+type: Opaque
+data:
+  APP_SECRET: "<BASE64_ENCODED_APP_SECRET>"
+
+---
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ocir-credentials
+  namespace: oci-cis-agent
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: "<BASE64_ENCODED_DOCKER_CONFIG_JSON>"

deploy/k8s/service.yaml

@@ -0,0 +1,42 @@
+##
+## Backend service — ClusterIP (internal only)
+## Named "backend" so the frontend nginx proxy_pass http://backend:8000/api/ resolves via K8s DNS.
+##
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend
+  namespace: oci-cis-agent
+  labels:
+    app: oci-cis-agent-backend
+spec:
+  type: ClusterIP
+  selector:
+    app: oci-cis-agent-backend
+  ports:
+    - port: 8000
+      targetPort: 8000
+      protocol: TCP
+
+---
+
+##
+## Frontend service — NodePort
+## nodePort 30080 matches the OCI Load Balancer backend set.
+##
+apiVersion: v1
+kind: Service
+metadata:
+  name: frontend
+  namespace: oci-cis-agent
+  labels:
+    app: oci-cis-agent-frontend
+spec:
+  type: NodePort
+  selector:
+    app: oci-cis-agent-frontend
+  ports:
+    - port: 80
+      targetPort: 80
+      nodePort: 30080
+      protocol: TCP