feat: OCI deployment — Terraform VM + OKE stacks, OCIR, K8s manifests

- terraform-vm/: ARM VM (A1.Flex Free Tier), Docker Compose, Block Volume, LB+WAF+SSL
- terraform-oke/: OKE cluster (3 nodes Intel), NodePort, LB+WAF+SSL
- k8s/: namespace, deployments, services, PVC, secrets, configmap
- Dockerfile.frontend: self-contained nginx+dist image
- push-images.sh: multi-arch build (amd64+arm64) + push to OCIR
- dns.tf: conditional OCI DNS Zone + A record (when domain available)
- Both stacks 100% independent, no shared modules
- .gitignore: terraform state, .terraform/, *.tfvars

deploy/terraform-oke/lb.tf

@@ -0,0 +1,157 @@
+# -----------------------------------------------------------------------------
+# OCI CIS Agent — OKE Deployment Stack
+# Load Balancer: Self-Signed TLS, HTTPS/HTTP Listeners, Backend Set
+# -----------------------------------------------------------------------------
+
+# --- Self-Signed TLS Certificate ---
+
+resource "tls_private_key" "lb" {
+  algorithm = "RSA"
+  rsa_bits  = 2048
+}
+
+resource "tls_self_signed_cert" "lb" {
+  private_key_pem = tls_private_key.lb.private_key_pem
+
+  subject {
+    common_name  = var.domain_name != "" ? var.domain_name : "oci-cis-agent.local"
+    organization = "OCI CIS Agent"
+  }
+
+  validity_period_hours = 8760 # 1 year
+  is_ca_certificate     = false
+
+  allowed_uses = [
+    "key_encipherment",
+    "digital_signature",
+    "server_auth",
+  ]
+}
+
+# --- Load Balancer ---
+
+resource "oci_load_balancer_load_balancer" "main" {
+  compartment_id = var.compartment_ocid
+  display_name   = "cisagent-oke-lb"
+  shape          = "flexible"
+
+  shape_details {
+    minimum_bandwidth_in_mbps = var.lb_min_bandwidth_mbps
+    maximum_bandwidth_in_mbps = var.lb_max_bandwidth_mbps
+  }
+
+  subnet_ids = [oci_core_subnet.public.id]
+
+  is_private = false
+
+  freeform_tags = var.freeform_tags
+}
+
+# --- Certificate ---
+
+resource "oci_load_balancer_certificate" "main" {
+  load_balancer_id   = oci_load_balancer_load_balancer.main.id
+  certificate_name   = "cisagent-self-signed"
+  public_certificate = tls_self_signed_cert.lb.cert_pem
+  private_key        = tls_private_key.lb.private_key_pem
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+# --- Backend Set ---
+# Backends point to worker node IPs on the fixed NodePort.
+# The K8s Service must use spec.type=NodePort with nodePort=30080.
+
+resource "oci_load_balancer_backend_set" "app" {
+  load_balancer_id = oci_load_balancer_load_balancer.main.id
+  name             = "cisagent-backend-set"
+  policy           = "ROUND_ROBIN"
+
+  health_checker {
+    protocol          = "HTTP"
+    port              = var.node_port
+    url_path          = "/api/health"
+    return_code       = 200
+    interval_ms       = 10000
+    timeout_in_millis = 5000
+    retries           = 3
+  }
+}
+
+# --- Backends (one per worker node) ---
+# Uses node private IPs from the node pool data source.
+
+resource "oci_load_balancer_backend" "nodes" {
+  for_each = {
+    for idx, node in data.oci_containerengine_node_pool.app.nodes :
+    idx => node
+    if node.state == "ACTIVE"
+  }
+
+  load_balancer_id = oci_load_balancer_load_balancer.main.id
+  backendset_name  = oci_load_balancer_backend_set.app.name
+  ip_address       = each.value.private_ip
+  port             = var.node_port
+  weight           = 1
+}
+
+# --- HTTPS Listener (443) ---
+
+resource "oci_load_balancer_listener" "https" {
+  load_balancer_id         = oci_load_balancer_load_balancer.main.id
+  name                     = "cisagent-https"
+  default_backend_set_name = oci_load_balancer_backend_set.app.name
+  port                     = 443
+  protocol                 = "HTTP"
+
+  ssl_configuration {
+    certificate_name        = oci_load_balancer_certificate.main.certificate_name
+    verify_peer_certificate = false
+    protocols               = ["TLSv1.2", "TLSv1.3"]
+  }
+}
+
+# --- HTTP Listener (80) with redirect to HTTPS ---
+
+resource "oci_load_balancer_listener" "http_redirect" {
+  load_balancer_id         = oci_load_balancer_load_balancer.main.id
+  name                     = "cisagent-http-redirect"
+  default_backend_set_name = oci_load_balancer_backend_set.app.name
+  port                     = 80
+  protocol                 = "HTTP"
+  rule_set_names           = [oci_load_balancer_rule_set.http_redirect.name]
+
+  connection_configuration {
+    idle_timeout_in_seconds = 60
+  }
+}
+
+# --- Rule Set: HTTP to HTTPS Redirect ---
+
+resource "oci_load_balancer_rule_set" "http_redirect" {
+  load_balancer_id = oci_load_balancer_load_balancer.main.id
+  name             = "http-to-https-redirect"
+
+  items {
+    action      = "REDIRECT"
+    description = "Redirect HTTP to HTTPS"
+
+    conditions {
+      attribute_name  = "PATH"
+      attribute_value = "/"
+      operator        = "FORCE_LONGEST_PREFIX_MATCH"
+    }
+
+    redirect_uri {
+      protocol = "HTTPS"
+      port     = 443
+      host     = "{host}"
+      path     = "/{path}"
+      query    = "?{query}"
+    }
+
+    response_code = 301
+  }
+}