feat: OCI deployment — Terraform VM + OKE stacks, OCIR, K8s manifests

- terraform-vm/: ARM VM (A1.Flex Free Tier), Docker Compose, Block Volume, LB+WAF+SSL
- terraform-oke/: OKE cluster (3 nodes Intel), NodePort, LB+WAF+SSL
- k8s/: namespace, deployments, services, PVC, secrets, configmap
- Dockerfile.frontend: self-contained nginx+dist image
- push-images.sh: multi-arch build (amd64+arm64) + push to OCIR
- dns.tf: conditional OCI DNS Zone + A record (when domain available)
- Both stacks 100% independent, no shared modules
- .gitignore: terraform state, .terraform/, *.tfvars

deploy/terraform-vm/terraform.tfvars.example

@@ -0,0 +1,55 @@
+# =============================================================================
+# OCI CIS Agent — VM Deployment Variables
+# =============================================================================
+# Copy this file to terraform.tfvars and fill in the values.
+# Required values are marked with <REQUIRED>.
+# =============================================================================
+
+# --- OCI Authentication ---
+tenancy_ocid     = "<REQUIRED>"
+user_ocid        = "<REQUIRED>"
+fingerprint      = "<REQUIRED>"
+private_key_path = "<REQUIRED>"  # e.g. "~/.oci/oci_api_key.pem"
+region           = "us-ashburn-1"
+
+# --- Compartment ---
+compartment_ocid = "<REQUIRED>"
+
+# --- Networking (defaults are usually fine) ---
+# vcn_cidr            = "10.0.0.0/16"
+# public_subnet_cidr  = "10.0.1.0/24"
+# private_subnet_cidr = "10.0.2.0/24"
+
+# --- Compute Instance ---
+# instance_shape     = "VM.Standard.A1.Flex"
+# instance_ocpus     = 2
+# instance_memory_gb = 16
+ssh_public_key = "<REQUIRED>"  # contents of ~/.ssh/id_rsa.pub
+
+# --- Block Volume ---
+# block_volume_size_gb     = 50
+# block_volume_vpus_per_gb = 20
+
+# --- Application ---
+app_secret = "<REQUIRED>"  # generate with: python3 -c "import secrets; print(secrets.token_hex(64))"
+# jwt_expiry_hours = 12
+# app_timezone     = "UTC"
+
+# --- OCIR ---
+ocir_namespace  = "<REQUIRED>"  # tenancy Object Storage namespace
+ocir_username   = "<REQUIRED>"  # e.g. "user@email.com" (without namespace prefix)
+ocir_auth_token = "<REQUIRED>"  # generate in OCI Console > User Settings > Auth Tokens
+# ocir_repo_prefix = "oci-cis-agent"
+
+# --- Load Balancer ---
+# lb_min_bandwidth_mbps = 10
+# lb_max_bandwidth_mbps = 100
+
+# --- DNS (optional — leave empty to skip) ---
+# domain_name = ""
+
+# --- Tags ---
+# freeform_tags = {
+#   "Project"   = "oci-cis-agent"
+#   "ManagedBy" = "terraform"
+# }