144 lines
4.7 KiB
HCL
144 lines
4.7 KiB
HCL
# -----------------------------------------------------------------------------
|
|
# Self-Signed TLS Certificate (fallback when no domain)
|
|
# -----------------------------------------------------------------------------
|
|
resource "tls_private_key" "lb" {
|
|
algorithm = "RSA"
|
|
rsa_bits = 2048
|
|
}
|
|
|
|
resource "tls_self_signed_cert" "lb" {
|
|
private_key_pem = tls_private_key.lb.private_key_pem
|
|
|
|
subject {
|
|
common_name = var.domain_name != "" ? var.domain_name : "cisagent.local"
|
|
organization = "OCI CIS Agent"
|
|
}
|
|
|
|
validity_period_hours = 8760 # 1 year
|
|
|
|
allowed_uses = [
|
|
"key_encipherment",
|
|
"digital_signature",
|
|
"server_auth",
|
|
]
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Load Balancer
|
|
# -----------------------------------------------------------------------------
|
|
resource "oci_load_balancer_load_balancer" "main" {
|
|
compartment_id = var.compartment_ocid
|
|
display_name = "cisagent-lb"
|
|
shape = "flexible"
|
|
freeform_tags = var.freeform_tags
|
|
|
|
shape_details {
|
|
minimum_bandwidth_in_mbps = var.lb_min_bandwidth_mbps
|
|
maximum_bandwidth_in_mbps = var.lb_max_bandwidth_mbps
|
|
}
|
|
|
|
subnet_ids = [oci_core_subnet.public.id]
|
|
|
|
is_private = false
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Certificate
|
|
# -----------------------------------------------------------------------------
|
|
resource "oci_load_balancer_certificate" "self_signed" {
|
|
load_balancer_id = oci_load_balancer_load_balancer.main.id
|
|
certificate_name = "cisagent-self-signed"
|
|
public_certificate = tls_self_signed_cert.lb.cert_pem
|
|
private_key = tls_private_key.lb.private_key_pem
|
|
|
|
lifecycle {
|
|
create_before_destroy = true
|
|
}
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Backend Set
|
|
# -----------------------------------------------------------------------------
|
|
resource "oci_load_balancer_backend_set" "app" {
|
|
load_balancer_id = oci_load_balancer_load_balancer.main.id
|
|
name = "cisagent-backend-set"
|
|
policy = "ROUND_ROBIN"
|
|
|
|
health_checker {
|
|
protocol = "HTTP"
|
|
port = 8080
|
|
url_path = "/api/health"
|
|
interval_ms = 10000
|
|
timeout_in_millis = 5000
|
|
retries = 3
|
|
return_code = 200
|
|
}
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Backend
|
|
# -----------------------------------------------------------------------------
|
|
resource "oci_load_balancer_backend" "app" {
|
|
load_balancer_id = oci_load_balancer_load_balancer.main.id
|
|
backendset_name = oci_load_balancer_backend_set.app.name
|
|
ip_address = oci_core_instance.app.private_ip
|
|
port = 8080
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# HTTPS Listener (443)
|
|
# -----------------------------------------------------------------------------
|
|
resource "oci_load_balancer_listener" "https" {
|
|
load_balancer_id = oci_load_balancer_load_balancer.main.id
|
|
name = "cisagent-https-listener"
|
|
default_backend_set_name = oci_load_balancer_backend_set.app.name
|
|
port = 443
|
|
protocol = "HTTP"
|
|
|
|
ssl_configuration {
|
|
certificate_name = oci_load_balancer_certificate.self_signed.certificate_name
|
|
verify_peer_certificate = false
|
|
protocols = ["TLSv1.2", "TLSv1.3"]
|
|
}
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# HTTP → HTTPS Redirect Rule Set
|
|
# -----------------------------------------------------------------------------
|
|
resource "oci_load_balancer_rule_set" "redirect_http_to_https" {
|
|
load_balancer_id = oci_load_balancer_load_balancer.main.id
|
|
name = "redirect-http-to-https"
|
|
|
|
items {
|
|
action = "REDIRECT"
|
|
|
|
conditions {
|
|
attribute_name = "PATH"
|
|
attribute_value = "/"
|
|
operator = "FORCE_LONGEST_PREFIX_MATCH"
|
|
}
|
|
|
|
redirect_uri {
|
|
protocol = "HTTPS"
|
|
port = 443
|
|
host = "{host}"
|
|
path = "/{path}"
|
|
query = "?{query}"
|
|
}
|
|
|
|
response_code = 301
|
|
}
|
|
}
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# HTTP Listener (80) with Redirect
|
|
# -----------------------------------------------------------------------------
|
|
resource "oci_load_balancer_listener" "http" {
|
|
load_balancer_id = oci_load_balancer_load_balancer.main.id
|
|
name = "cisagent-http-listener"
|
|
default_backend_set_name = oci_load_balancer_backend_set.app.name
|
|
port = 80
|
|
protocol = "HTTP"
|
|
rule_set_names = [oci_load_balancer_rule_set.redirect_http_to_https.name]
|
|
}
|