Carga inicial
This commit is contained in:
Guilherme Silva
210
README.md
210
README.md
@@ -1,3 +1,209 @@
|
||||
# iac-sei
|
||||
# Documentacao repositório iac-sei
|
||||
|
||||
Repositório para armazenamento do código terraform para o SEI
|
||||
|
||||
## Introducao geral
|
||||
|
||||
Este conjunto de arquivos Terraform provisiona uma arquitetura OCI para o ambiente SEI. A stack cria recursos de computacao, rede, balanceamento de carga, armazenamento compartilhado, logging, backup, WAF e seguranca por Vault. O desenho geral usa uma rede em camadas: um load balancer publico recebe o trafego HTTP/HTTPS/SOLR, encaminha as requisicoes para instancias privadas SEI, SIP e SOLR, e os servidores de aplicacao acessam servicos internos como banco MySQL, Memcached, JodServer e File Storage.
|
||||
|
||||
As instancias sao criadas com Oracle Linux 9, sem IP publico, distribuidas entre fault domains e inicializadas por arquivos `cloud-init` especificos por papel. O codigo tambem gera uma chave SSH master e uma senha administrativa MySQL, armazenando esses segredos no OCI Vault protegido por chave KMS criada no proprio Terraform.
|
||||
|
||||
## Visao geral dos componentes
|
||||
|
||||
| Componente | Arquivos principais | O que e provisionado |
|
||||
| --- | --- | --- |
|
||||
| Provider e data sources | `providers.tf`, `data_sources.tf` | Provider OCI, imagem Oracle Linux 9 mais recente, availability domain, fault domains e configuracoes MySQL. |
|
||||
| Compute | `server_instances_*.tf` | Instancias SEI, SIP, SOLR, Memcached e JodServer. |
|
||||
| Rede e NSGs | `nsg-*.tf` | Network Security Groups e regras para load balancer, aplicacao, SOLR, Memcached, JodServer e banco. |
|
||||
| Load balancer | `sei_public_load_balancer.tf` | Load balancer publico flexivel, backend sets, backends, listeners, hostnames e logs. |
|
||||
| File Storage | `fss_server.tf`, `variables_sei_nfs.tf` | File system SEI, mount target, export set, export `/dados` e snapshot policy opcional. |
|
||||
| Vault e senhas | `vault.tf`, `generation_keys.tf` | Vault, KMS key, chave SSH master, senha MySQL e secrets no OCI Vault. |
|
||||
| Backup | `boot_volume_backups.tf` | Politica opcional de backup e volume group com boot volumes das instancias. |
|
||||
| WAF | `sei_waf.tf` | Politica WAF opcional, Web App Firewall vinculado ao load balancer e log WAF. |
|
||||
| Logging | `logging_group.tf`, `sei_public_load_balancer.tf`, `sei_waf.tf` | Grupo de logs e logs de acesso/erro do load balancer e do WAF. |
|
||||
|
||||
## Armazenamento de senhas e segredos no Vault
|
||||
|
||||
O codigo evidencia uma estrategia de centralizacao de segredos no OCI Vault:
|
||||
|
||||
| Recurso | Arquivo | Funcao |
|
||||
| --- | --- | --- |
|
||||
| `oci_kms_vault.vault-sei` | `vault.tf` | Cria o Vault `sei-vault-${environment}` no compartimento de seguranca. |
|
||||
| `oci_kms_key.sei-vault-keys` | `vault.tf` | Cria uma chave KMS AES de 32 bytes usada para criptografar os secrets. |
|
||||
| `tls_private_key.master_ssh_key` | `generation_keys.tf` | Gera uma chave SSH RSA 4096 bits usada como chave autorizada das instancias. |
|
||||
| `random_password.password_mysql_admin` | `generation_keys.tf` | Gera senha MySQL de 16 caracteres com numero, maiuscula, minuscula e caractere especial. |
|
||||
| `oci_vault_secret.sei_oci_vault_secret_private_key` | `generation_keys.tf` | Armazena a chave SSH privada como secret `master-private-ssh-key`. |
|
||||
| `oci_vault_secret.sei_oci_vault_secret_pulbic_key` | `generation_keys.tf` | Armazena a chave SSH publica como secret `master-public-ssh-key`. |
|
||||
| `oci_vault_secret.sei_oci_vault_secret_mysql` | `generation_keys.tf` | Armazena a senha MySQL gerada como secret `master-mysql-password`. |
|
||||
|
||||
Todos os secrets gravados em `oci_vault_secret` usam `content_type = "BASE64"` e o conteudo e enviado por `base64encode(...)`. A chave SSH publica tambem e usada diretamente no `metadata.ssh_authorized_keys` das instancias de compute.
|
||||
|
||||
Ponto de atencao: embora os secrets sejam armazenados no OCI Vault, valores gerados por recursos Terraform podem ficar registrados no Terraform state. O state deve ser protegido com controle de acesso, criptografia e backend adequado.
|
||||
|
||||
## Arquivos Terraform
|
||||
|
||||
| Arquivo | Descricao |
|
||||
| --- | --- |
|
||||
| `providers.tf` | Configura o provider OCI com tenancy, usuario, fingerprint, chave privada e regiao. |
|
||||
| `variables.tf` | Declara as variaveis principais da stack. |
|
||||
| `variables_sei_nfs.tf` | Declara variaveis especificas de NFS/FSS. |
|
||||
| `terraform.tfvars` | Define valores de exemplo/ambiente para as variaveis. |
|
||||
| `data_sources.tf` | Consulta imagem Oracle Linux 9, ADs, FDs e configuracoes MySQL. |
|
||||
| `server_instances_sei.tf` | Cria instancias SEI com `cloud-init-sei.yaml`. |
|
||||
| `server_instances_sip.tf` | Cria instancias SIP com `cloud-init-sip.yaml`. |
|
||||
| `server_instances_solr.tf` | Cria instancias SOLR com disco de boot customizado e `cloud-init-solr.yaml`. |
|
||||
| `server_instances_memcached.tf` | Cria instancias Memcached com `cloud-init-memcached.yaml`. |
|
||||
| `server_instances_jod.tf` | Cria instancias JodServer com `cloud-init-jod.yaml`. |
|
||||
| `sei_public_load_balancer.tf` | Cria load balancer publico, backends, listeners, hostnames e logs. |
|
||||
| `nsg-sei-lbs-nsg.tf` | Cria NSG do load balancer publico. |
|
||||
| `nsg-sei-servers-nsg.tf` | Cria NSG dos servidores SEI. |
|
||||
| `nsg-sip-servers-nsg.tf` | Cria NSG dos servidores SIP. |
|
||||
| `nsg-solr-servers-nsg.tf` | Cria NSG dos servidores SOLR. |
|
||||
| `nsg-memcached-servers-nsg.tf` | Cria NSG dos servidores Memcached. |
|
||||
| `nsg-jod-servers-nsg.tf` | Cria NSG dos servidores JodServer. |
|
||||
| `nsg-database-nsg.tf` | Cria NSG de banco de dados. |
|
||||
| `fss_server.tf` | Cria File Storage, mount target, export e snapshot policy opcional. |
|
||||
| `vault.tf` | Cria Vault e chave KMS. |
|
||||
| `generation_keys.tf` | Gera chave SSH e senha MySQL, salvando os valores em secrets no Vault. |
|
||||
| `boot_volume_backups.tf` | Cria politica opcional de backup dos boot volumes. |
|
||||
| `logging_group.tf` | Cria grupo de logs. |
|
||||
| `sei_waf.tf` | Cria WAF opcional e log de WAF. |
|
||||
|
||||
## Variaveis
|
||||
|
||||
### Autenticacao e provider
|
||||
|
||||
| Variavel | Tipo declarado | Valor em `terraform.tfvars` / default | Descricao |
|
||||
| --- | --- | --- | --- |
|
||||
| `tenancy_ocid` | Nao declarado | `""` | OCID da tenancy OCI. Usado pelo provider e pelos data sources de identity. |
|
||||
| `user_ocid` | Nao declarado | `""` | OCID do usuario OCI usado para autenticar o provider. |
|
||||
| `fingerprint` | Nao declarado | `""` | Fingerprint da API key OCI. |
|
||||
| `private_key_path` | Nao declarado | `/home/opc/.oci/terraform_key.pem` | Caminho local da chave privada da API OCI. |
|
||||
| `region` | Nao declarado | `sa-saopaulo-1` | Regiao OCI onde os recursos serao criados. |
|
||||
|
||||
### Ambiente
|
||||
|
||||
| Variavel | Tipo declarado | Valor em `terraform.tfvars` / default | Descricao |
|
||||
| --- | --- | --- | --- |
|
||||
| `environment` | `string` | `hml` | Identificador do ambiente. E usado em nomes de instancias, vault, FSS, backup, WAF, logs e load balancer. |
|
||||
|
||||
### Compartimentos
|
||||
|
||||
| Variavel | Tipo declarado | Valor em `terraform.tfvars` / default | Descricao |
|
||||
| --- | --- | --- | --- |
|
||||
| `ocid_compartment_app` | Nao declarado | `""` | Compartimento para instancias, FSS, logging group, data source de imagens e backups. |
|
||||
| `ocid_compartment_database` | Nao declarado | `""` | Compartimento previsto para banco de dados. Foi declarado, mas nao ha uso direto nos arquivos raiz atuais. |
|
||||
| `ocid_compartment_security` | Nao declarado | `""` | Compartimento de seguranca usado para Vault, KMS key, secrets e logs do WAF. |
|
||||
| `ocid_compartment_networking` | Nao declarado | `""` | Compartimento de rede usado por NSGs, load balancer, logs do load balancer e WAF. |
|
||||
|
||||
### Rede
|
||||
|
||||
| Variavel | Tipo declarado | Valor em `terraform.tfvars` / default | Descricao |
|
||||
| --- | --- | --- | --- |
|
||||
| `ocid_vcn_3_tier` | Nao declarado | `""` | OCID da VCN onde os NSGs sao criados. |
|
||||
| `ocid_subnet_app` | Nao declarado | `""` | OCID da subnet privada de aplicacao usada pelas instancias e pelo mount target do FSS. |
|
||||
| `ocid_subnet_database` | Nao declarado | `""` | OCID da subnet de banco. Foi declarado, mas as regras usam o CIDR `cidr_subnet_database`; nao ha uso direto deste OCID nos arquivos raiz atuais. |
|
||||
| `ocid_subnet_public` | Nao declarado | `""` | OCID da subnet publica onde o load balancer e criado. |
|
||||
|
||||
### CIDRs
|
||||
|
||||
| Variavel | Tipo declarado | Valor em `terraform.tfvars` / default | Descricao |
|
||||
| --- | --- | --- | --- |
|
||||
| `cidr_subnet_app` | Nao declarado | `172.20.2.64/26` | CIDR da subnet de aplicacao. Usado em regras NSG para acesso interno entre aplicacao, SOLR, Memcached, JodServer e banco. |
|
||||
| `cidr_subnet_database` | Nao declarado | `172.20.2.128/26` | CIDR da subnet de banco. Usado como destino para MySQL `3306` e MySQL HeatWave `33060`. |
|
||||
| `cidr_subnet_web` | Nao declarado | `172.20.2.0/26` | CIDR da camada web/load balancer. Usado como origem para entrada em SEI, SIP e SOLR. |
|
||||
| `cidr_anywhere` | Nao declarado | `0.0.0.0/0` | CIDR aberto para internet. Usado no NSG do load balancer para HTTP `80` e HTTPS `443`. |
|
||||
|
||||
### Instancias SEI
|
||||
|
||||
| Variavel | Tipo declarado | Valor em `terraform.tfvars` / default | Descricao |
|
||||
| --- | --- | --- | --- |
|
||||
| `sei_amount_instances` | Nao declarado | `1` | Quantidade de instancias SEI criadas por `oci_core_instance.sei-instance`. |
|
||||
| `sei_prefix_hostname` | Nao declarado | `sei-server` | Prefixo do nome das instancias SEI. |
|
||||
| `sei_shape` | Nao declarado | `VM.Standard.E4.Flex` | Shape das instancias SEI. Tambem e usado para buscar a imagem Oracle Linux 9 mais recente. |
|
||||
| `sei_amount_memory` | Nao declarado | `4` | Memoria em GB das instancias SEI. |
|
||||
| `sei_amount_ocpus` | Nao declarado | `1` | OCPUs das instancias SEI. |
|
||||
| `sei_fqdn` | Nao declarado | `""` | FQDN/hostname do SEI no load balancer. |
|
||||
|
||||
### Instancias SIP
|
||||
|
||||
| Variavel | Tipo declarado | Valor em `terraform.tfvars` / default | Descricao |
|
||||
| --- | --- | --- | --- |
|
||||
| `sip_amount_instances` | Nao declarado | `1` | Quantidade de instancias SIP criadas por `oci_core_instance.sip-instance`. |
|
||||
| `sip_prefix_hostname` | Nao declarado | `sip-server` | Prefixo do nome das instancias SIP. |
|
||||
| `sip_shape` | Nao declarado | `VM.Standard.E4.Flex` | Shape das instancias SIP. |
|
||||
| `sip_amount_memory` | Nao declarado | `4` | Memoria em GB das instancias SIP. |
|
||||
| `sip_amount_ocpus` | Nao declarado | `1` | OCPUs das instancias SIP. |
|
||||
| `sip_fqdn` | Nao declarado | `""` | FQDN/hostname do SIP no load balancer. |
|
||||
|
||||
### Instancias SOLR
|
||||
|
||||
| Variavel | Tipo declarado | Valor em `terraform.tfvars` / default | Descricao |
|
||||
| --- | --- | --- | --- |
|
||||
| `solr_amount_instances` | Nao declarado | `2` | Quantidade de instancias SOLR criadas por `oci_core_instance.solr-instance`. |
|
||||
| `solr_prefix_hostname` | Nao declarado | `solr-server` | Prefixo do nome das instancias SOLR. |
|
||||
| `solr_shape` | Nao declarado | `VM.Standard.E4.Flex` | Shape das instancias SOLR. |
|
||||
| `solr_amount_memory` | Nao declarado | `8` | Memoria em GB das instancias SOLR. |
|
||||
| `solr_amount_ocpus` | Nao declarado | `1` | OCPUs das instancias SOLR. |
|
||||
| `solr_boot_disk_size` | Nao declarado | `200` | Tamanho do boot volume das instancias SOLR, em GB. |
|
||||
| `solr_fqdn` | Nao declarado | `""` | FQDN/hostname do SOLR no load balancer. |
|
||||
|
||||
### Instancias Memcached
|
||||
|
||||
| Variavel | Tipo declarado | Valor em `terraform.tfvars` / default | Descricao |
|
||||
| --- | --- | --- | --- |
|
||||
| `memcached_amount_instances` | Nao declarado | `1` | Quantidade de instancias Memcached criadas por `oci_core_instance.memcached-instance`. |
|
||||
| `memcached_prefix_hostname` | Nao declarado | `memcached-server` | Prefixo do nome das instancias Memcached. |
|
||||
| `memcached_shape` | Nao declarado | `VM.Standard.E4.Flex` | Shape das instancias Memcached. |
|
||||
| `memcached_amount_memory` | Nao declarado | `2` | Memoria em GB das instancias Memcached. |
|
||||
| `memcached_amount_ocpus` | Nao declarado | `1` | OCPUs das instancias Memcached. |
|
||||
|
||||
### Instancias JodServer
|
||||
|
||||
| Variavel | Tipo declarado | Valor em `terraform.tfvars` / default | Descricao |
|
||||
| --- | --- | --- | --- |
|
||||
| `jod_amount_instances` | Nao declarado | `1` | Quantidade de instancias JodServer criadas por `oci_core_instance.jod-instance`. |
|
||||
| `jod_prefix_hostname` | Nao declarado | `jod-server` | Prefixo do nome das instancias JodServer. |
|
||||
| `jod_shape` | Nao declarado | `VM.Standard.E4.Flex` | Shape das instancias JodServer. |
|
||||
| `jod_amount_memory` | Nao declarado | `2` | Memoria em GB das instancias JodServer. |
|
||||
| `jod_amount_ocpus` | Nao declarado | `1` | OCPUs das instancias JodServer. |
|
||||
|
||||
### Load balancer
|
||||
|
||||
| Variavel | Tipo declarado | Valor em `terraform.tfvars` / default | Descricao |
|
||||
| --- | --- | --- | --- |
|
||||
| `load_balancer_prefix_hostname` | Nao declarado | `sei-load-balancer` | Prefixo do nome do load balancer publico. |
|
||||
| `load_balancer_maximum_bandwidth_in_mbps` | Nao declarado | `100` | Banda maxima do load balancer flexivel, em Mbps. |
|
||||
| `load_balancer_minimum_bandwidth_in_mbps` | Nao declarado | `10` | Banda minima do load balancer flexivel, em Mbps. |
|
||||
|
||||
### FSS / NFS
|
||||
|
||||
| Variavel | Tipo declarado | Valor em `terraform.tfvars` / default | Descricao |
|
||||
| --- | --- | --- | --- |
|
||||
| `fss_backup` | Nao declarado | `false` em `terraform.tfvars` | Habilita a politica de snapshot diario do File Storage. No codigo raiz e usado como booleano em `var.fss_backup ? ... : ...`. |
|
||||
| `sei_nfs_name` | `string` | `nfs-sei` | Nome do FSS/NFS para o SEI. Declarado em `variables_sei_nfs.tf`; nao ha uso direto identificado nos arquivos raiz atuais. |
|
||||
| `sei_mount_target_ip_address` | `string` | `10.191.228.100` | IP planejado para o mount target. Declarado em `variables_sei_nfs.tf`; nao ha uso direto identificado nos arquivos raiz atuais. |
|
||||
|
||||
### WAF e backups
|
||||
|
||||
| Variavel | Tipo declarado | Valor em `terraform.tfvars` / default | Descricao |
|
||||
| --- | --- | --- | --- |
|
||||
| `enable_waf` | Nao declarado | `false` | Habilita a criacao da politica WAF, Web App Firewall, associacao ao load balancer e log WAF. No codigo e usado como booleano. |
|
||||
| `enable_boot_volume_backup` | Nao declarado | `false` | Habilita a politica de backup dos boot volumes. No codigo e comparado como string: `var.enable_boot_volume_backup == "true"`. |
|
||||
|
||||
## Regras de rede resumidas
|
||||
|
||||
| NSG | Direcao | Origem/Destino | Portas | Objetivo |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| Load balancer publico | Ingress | `cidr_anywhere` | 80, 443 | Entrada publica HTTP/HTTPS. |
|
||||
| Load balancer publico | Ingress | `cidr_subnet_app` | 8983 | Entrada SOLR a partir da subnet de aplicacao. |
|
||||
| SEI servers | Ingress | `cidr_subnet_web` | 80, 443, 8983 | Entrada vinda da camada web/load balancer. |
|
||||
| SEI servers | Egress | `cidr_subnet_database` | 3306, 33060 | Acesso MySQL/MySQL HeatWave. |
|
||||
| SEI servers | Egress | `cidr_subnet_app` | 8983, 11211, 8080 | Acesso a SOLR, Memcached e JodServer. |
|
||||
| SIP servers | Ingress | `cidr_subnet_web` | 80, 443, 8983 | Entrada vinda da camada web/load balancer. |
|
||||
| SIP servers | Egress | `cidr_subnet_database` | 3306, 33060 | Acesso MySQL/MySQL HeatWave. |
|
||||
| SIP servers | Egress | `cidr_subnet_app` | 8983, 11211 | Acesso a SOLR e Memcached. |
|
||||
| SOLR servers | Ingress | `cidr_subnet_web`, `cidr_subnet_app` | 8983 | Trafego SOLR. |
|
||||
| SOLR servers | Egress | `cidr_subnet_app` | 11211 | Acesso Memcached. |
|
||||
| Memcached servers | Ingress | `cidr_subnet_app` | 11211 | Trafego Memcached. |
|
||||
| JodServer | Ingress | `cidr_subnet_app` | 8080 | Trafego JodServer. |
|
||||
| Database | Ingress | `cidr_subnet_app` | 3306, 33060 | Trafego MySQL/MySQL HeatWave. |
|
||||
|
||||
67
boot_volume_backups.tf
Executable file
67
boot_volume_backups.tf
Executable file
@@ -0,0 +1,67 @@
|
||||
resource "oci_core_volume_backup_policy" "sei_backup_policy" {
|
||||
count = var.enable_boot_volume_backup == "true" ? 1 : 0
|
||||
compartment_id = var.ocid_compartment_app
|
||||
display_name = "sei-backup-policy-${var.environment}"
|
||||
schedules {
|
||||
backup_type = "FULL"
|
||||
day_of_month = -1
|
||||
day_of_week = "SUNDAY"
|
||||
hour_of_day = 0
|
||||
offset_seconds = 0
|
||||
offset_type = "STRUCTURED"
|
||||
period = "ONE_WEEK"
|
||||
retention_seconds = 604800
|
||||
time_zone = "REGIONAL_DATA_CENTER_TIME"
|
||||
}
|
||||
schedules {
|
||||
backup_type = "FULL"
|
||||
day_of_month = 1
|
||||
hour_of_day = 0
|
||||
offset_seconds = 0
|
||||
offset_type = "STRUCTURED"
|
||||
period = "ONE_MONTH"
|
||||
retention_seconds = 16070400
|
||||
time_zone = "REGIONAL_DATA_CENTER_TIME"
|
||||
}
|
||||
schedules {
|
||||
backup_type = "INCREMENTAL"
|
||||
day_of_month = -1
|
||||
hour_of_day = 0
|
||||
offset_seconds = 0
|
||||
offset_type = "STRUCTURED"
|
||||
period = "ONE_DAY"
|
||||
retention_seconds = 604800
|
||||
time_zone = "REGIONAL_DATA_CENTER_TIME"
|
||||
}
|
||||
}
|
||||
|
||||
data "oci_core_boot_volumes" "all_boot_volumes" {
|
||||
count = var.enable_boot_volume_backup == "true" ? 1 : 0
|
||||
compartment_id = var.ocid_compartment_app
|
||||
availability_domain = data.oci_identity_availability_domain.ad.name
|
||||
}
|
||||
|
||||
resource "oci_core_volume_backup_policy_assignment" "sei_volume_group_backup_assignment" {
|
||||
count = var.enable_boot_volume_backup == "true" ? 1 : 0
|
||||
asset_id = oci_core_volume_group.sei_servers_volume_group[count.index].id
|
||||
policy_id = oci_core_volume_backup_policy.sei_backup_policy[count.index].id
|
||||
}
|
||||
|
||||
resource "oci_core_volume_group" "sei_servers_volume_group" {
|
||||
count = var.enable_boot_volume_backup == "true" ? 1 : 0
|
||||
availability_domain = data.oci_identity_availability_domain.ad.name
|
||||
compartment_id = var.ocid_compartment_app
|
||||
|
||||
source_details {
|
||||
type = "volumeIds"
|
||||
volume_ids = concat(
|
||||
oci_core_instance.sei-instance[*].boot_volume_id,
|
||||
oci_core_instance.solr-instance[*].boot_volume_id,
|
||||
oci_core_instance.memcached-instance[*].boot_volume_id,
|
||||
oci_core_instance.sip-instance[*].boot_volume_id,
|
||||
oci_core_instance.jod-instance[*].boot_volume_id
|
||||
)
|
||||
}
|
||||
|
||||
display_name = "sei-volume-group-${var.environment}"
|
||||
}
|
||||
32
data_sources.tf
Executable file
32
data_sources.tf
Executable file
@@ -0,0 +1,32 @@
|
||||
# Copyright (c) 2023, 2025, Oracle and/or its affiliates.
|
||||
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
|
||||
|
||||
data "oci_core_images" "ol9_latest" {
|
||||
compartment_id = var.ocid_compartment_app
|
||||
operating_system = "Oracle Linux"
|
||||
operating_system_version = "9"
|
||||
shape = var.sei_shape
|
||||
sort_by = "TIMECREATED"
|
||||
sort_order = "DESC"
|
||||
}
|
||||
|
||||
data "oci_identity_availability_domain" "ad" {
|
||||
compartment_id = var.tenancy_ocid
|
||||
ad_number = 1
|
||||
}
|
||||
|
||||
data "oci_identity_availability_domains" "ads" {
|
||||
compartment_id = var.tenancy_ocid
|
||||
}
|
||||
|
||||
data "oci_identity_fault_domains" "fds" {
|
||||
availability_domain = data.oci_identity_availability_domains.ads.availability_domains[0].name
|
||||
compartment_id = var.tenancy_ocid
|
||||
}
|
||||
|
||||
data "oci_mysql_mysql_configurations" "sei_mysql_configurations" {
|
||||
compartment_id = var.ocid_compartment_app
|
||||
state = "ACTIVE"
|
||||
shape_name = "MySQL.4"
|
||||
type = ["DEFAULT"]
|
||||
}
|
||||
45
fss_server.tf
Normal file
45
fss_server.tf
Normal file
@@ -0,0 +1,45 @@
|
||||
|
||||
resource "oci_file_storage_file_system" "sei-fss" {
|
||||
availability_domain = data.oci_identity_availability_domain.ad.name
|
||||
compartment_id = var.ocid_compartment_app
|
||||
display_name = "var.sei_nfs_name-${var.environment}"
|
||||
filesystem_snapshot_policy_id = var.fss_backup ? oci_file_storage_filesystem_snapshot_policy.sei_filesystem_snapshot_policy[0].id : null
|
||||
}
|
||||
|
||||
resource "oci_file_storage_mount_target" "mount-target-sei" {
|
||||
availability_domain = data.oci_identity_availability_domain.ad.name
|
||||
compartment_id = var.ocid_compartment_app
|
||||
subnet_id = var.ocid_subnet_app
|
||||
display_name = "mount-target-sei-${var.environment}"
|
||||
requested_throughput = "1"
|
||||
hostname_label = "sei-fss-${var.environment}"
|
||||
}
|
||||
|
||||
resource "oci_file_storage_export_set" "dados" {
|
||||
mount_target_id = oci_file_storage_mount_target.mount-target-sei.id
|
||||
display_name = "dados"
|
||||
}
|
||||
|
||||
resource "oci_file_storage_export" "export-dados" {
|
||||
export_set_id = oci_file_storage_export_set.dados.id
|
||||
file_system_id = oci_file_storage_file_system.sei-fss.id
|
||||
path = "/dados"
|
||||
export_options {
|
||||
source = "0.0.0.0/0" #data.oci_core_subnet.app_subnet_ocid.cidr_block
|
||||
identity_squash = "NONE"
|
||||
require_privileged_source_port = true
|
||||
access = "READ_WRITE"
|
||||
}
|
||||
}
|
||||
resource "oci_file_storage_filesystem_snapshot_policy" "sei_filesystem_snapshot_policy" {
|
||||
count = var.fss_backup == "true" ? 1 : 0
|
||||
availability_domain = data.oci_identity_availability_domain.ad.name
|
||||
compartment_id = var.ocid_compartment_app
|
||||
display_name = "sei-fss-snapshot-policy-${var.environment}"
|
||||
policy_prefix = "fss-sei-${var.environment}"
|
||||
schedules {
|
||||
period = "DAILY"
|
||||
time_zone = "REGIONAL_DATA_CENTER_TIME"
|
||||
hour_of_day = "23"
|
||||
}
|
||||
}
|
||||
47
generation_keys.tf
Executable file
47
generation_keys.tf
Executable file
@@ -0,0 +1,47 @@
|
||||
resource "tls_private_key" "master_ssh_key" {
|
||||
algorithm = "RSA"
|
||||
rsa_bits = 4096
|
||||
}
|
||||
|
||||
resource "oci_vault_secret" "sei_oci_vault_secret_private_key" {
|
||||
compartment_id = var.ocid_compartment_security
|
||||
vault_id = oci_kms_vault.vault-sei.id
|
||||
key_id = oci_kms_key.sei-vault-keys.id
|
||||
secret_name = "master-private-ssh-key"
|
||||
secret_content {
|
||||
content_type = "BASE64"
|
||||
content = base64encode(tls_private_key.master_ssh_key.private_key_openssh)
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_vault_secret" "sei_oci_vault_secret_pulbic_key" {
|
||||
compartment_id = var.ocid_compartment_security
|
||||
vault_id = oci_kms_vault.vault-sei.id
|
||||
key_id = oci_kms_key.sei-vault-keys.id
|
||||
secret_name = "master-public-ssh-key"
|
||||
secret_content {
|
||||
content_type = "BASE64"
|
||||
content = base64encode(tls_private_key.master_ssh_key.public_key_openssh)
|
||||
}
|
||||
}
|
||||
|
||||
resource "random_password" "password_mysql_admin" {
|
||||
length = 16
|
||||
min_numeric = 1
|
||||
min_upper = 1
|
||||
min_lower = 1
|
||||
min_special = 1
|
||||
override_special = "_#-"
|
||||
}
|
||||
|
||||
resource "oci_vault_secret" "sei_oci_vault_secret_mysql" {
|
||||
compartment_id = var.ocid_compartment_security
|
||||
vault_id = oci_kms_vault.vault-sei.id
|
||||
key_id = oci_kms_key.sei-vault-keys.id
|
||||
secret_name = "master-mysql-password"
|
||||
secret_content {
|
||||
content_type = "BASE64"
|
||||
content = base64encode(random_password.password_mysql_admin.result)
|
||||
}
|
||||
}
|
||||
|
||||
4
logging_group.tf
Normal file
4
logging_group.tf
Normal file
@@ -0,0 +1,4 @@
|
||||
resource "oci_logging_log_group" "sei_log_group" {
|
||||
compartment_id = var.ocid_compartment_app
|
||||
display_name = "sei-log-group-${var.environment}"
|
||||
}
|
||||
37
nsg-database-nsg.tf
Executable file
37
nsg-database-nsg.tf
Executable file
@@ -0,0 +1,37 @@
|
||||
resource "oci_core_network_security_group" "db-server-nsg" {
|
||||
compartment_id = var.ocid_compartment_networking
|
||||
display_name = "db-servers-nsg"
|
||||
vcn_id = var.ocid_vcn_3_tier
|
||||
}
|
||||
|
||||
#--------------------------------------------------------------------------------------------------------------------------------------------
|
||||
resource "oci_core_network_security_group_security_rule" "nsg_db_security_ingress_rule_01" {
|
||||
network_security_group_id = oci_core_network_security_group.db-server-nsg.id
|
||||
description = "Ingress from sn-app."
|
||||
source = var.cidr_subnet_app
|
||||
source_type = "CIDR_BLOCK"
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 3306
|
||||
min = 3306
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "nsg_db_security_ingress_rule_02" {
|
||||
network_security_group_id = oci_core_network_security_group.db-server-nsg.id
|
||||
description = "Ingress from sn-app-pri."
|
||||
source = var.cidr_subnet_app
|
||||
source_type = "CIDR_BLOCK"
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 33060
|
||||
min = 33060
|
||||
}
|
||||
}
|
||||
}
|
||||
#--------------------------------------------------------------------------------------------------------------------------------------------
|
||||
22
nsg-jod-servers-nsg.tf
Executable file
22
nsg-jod-servers-nsg.tf
Executable file
@@ -0,0 +1,22 @@
|
||||
resource "oci_core_network_security_group" "jod-servers-nsg" {
|
||||
compartment_id = var.ocid_compartment_networking
|
||||
display_name = "jod-servers-nsg"
|
||||
vcn_id = var.ocid_vcn_3_tier
|
||||
}
|
||||
#--------------------------------------------------------------------------------------------------------------------------------------------
|
||||
resource "oci_core_network_security_group_security_rule" "jod_servers_security_ingress_rule_01" {
|
||||
network_security_group_id = oci_core_network_security_group.jod-servers-nsg.id
|
||||
description = "Ingress Jod from app-subnet."
|
||||
source = var.cidr_subnet_app
|
||||
source_type = "CIDR_BLOCK"
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 8080
|
||||
min = 8080
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#--------------------------------------------------------------------------------------------------------------------------------------------
|
||||
23
nsg-memcached-servers-nsg.tf
Executable file
23
nsg-memcached-servers-nsg.tf
Executable file
@@ -0,0 +1,23 @@
|
||||
resource "oci_core_network_security_group" "memcached-servers-nsg" {
|
||||
compartment_id = var.ocid_compartment_networking
|
||||
display_name = "memcached-servers-nsg"
|
||||
vcn_id = var.ocid_vcn_3_tier
|
||||
}
|
||||
#--------------------------------------------------------------------------------------------------------------------------------------------
|
||||
resource "oci_core_network_security_group_security_rule" "nsg_memcached_ingress_rule_01" {
|
||||
network_security_group_id = oci_core_network_security_group.memcached-servers-nsg.id
|
||||
description = "Ingress Memcached from app-subnet."
|
||||
source = var.cidr_subnet_app
|
||||
source_type = "CIDR_BLOCK"
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 11211
|
||||
min = 11211
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
#--------------------------------------------------------------------------------------------------------------------------------------------
|
||||
51
nsg-sei-lbs-nsg.tf
Executable file
51
nsg-sei-lbs-nsg.tf
Executable file
@@ -0,0 +1,51 @@
|
||||
resource "oci_core_network_security_group" "load-balancer-public-nsg" {
|
||||
compartment_id = var.ocid_compartment_networking
|
||||
display_name = "public-load-balancer-nsg"
|
||||
vcn_id = var.ocid_vcn_3_tier
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "nsg_lbr_security_rule_ingress_01" {
|
||||
network_security_group_id = oci_core_network_security_group.load-balancer-public-nsg.id
|
||||
description = "Ingress internet HTTP"
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
source = var.cidr_anywhere
|
||||
source_type = "CIDR_BLOCK"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 80
|
||||
min = 80
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "nsg_lbr_security_rule_ingress_02" {
|
||||
network_security_group_id = oci_core_network_security_group.load-balancer-public-nsg.id
|
||||
description = "Ingress internet HTTPs "
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
source = var.cidr_anywhere
|
||||
source_type = "CIDR_BLOCK"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 443
|
||||
min = 443
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "nsg_lbr_security_rule_ingress_03" {
|
||||
network_security_group_id = oci_core_network_security_group.load-balancer-public-nsg.id
|
||||
description = "Ingress internet OnP SOLR."
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
source = var.cidr_subnet_app
|
||||
source_type = "CIDR_BLOCK"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 8983
|
||||
min = 8983
|
||||
}
|
||||
}
|
||||
}
|
||||
#------------------------------------------------------------------------------------------------------------
|
||||
127
nsg-sei-servers-nsg.tf
Executable file
127
nsg-sei-servers-nsg.tf
Executable file
@@ -0,0 +1,127 @@
|
||||
resource "oci_core_network_security_group" "sei-servers-nsg" {
|
||||
compartment_id = var.ocid_compartment_networking
|
||||
display_name = "sei-servers-nsg"
|
||||
vcn_id = var.ocid_vcn_3_tier
|
||||
}
|
||||
#--------------------------------------------------------------------------------------------------------------------------------------------
|
||||
resource "oci_core_network_security_group_security_rule" "sei_servers_security_ingress_rule_01" {
|
||||
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
|
||||
description = "Ingress HTTP from Load Balancer."
|
||||
source = var.cidr_subnet_web
|
||||
source_type = "CIDR_BLOCK"
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 80
|
||||
min = 80
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "sei_servers_security_ingress_rule_02" {
|
||||
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
|
||||
description = "Ingress HTTPS from Load Balancer."
|
||||
source = var.cidr_subnet_web
|
||||
source_type = "CIDR_BLOCK"
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 443
|
||||
min = 443
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "sei_servers_security_ingress_rule_03" {
|
||||
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
|
||||
description = "Ingress SOLR from Load Balancer."
|
||||
source = var.cidr_subnet_web
|
||||
source_type = "CIDR_BLOCK"
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 8983
|
||||
min = 8983
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#--------------------------------------------------------------------------------------------------------------------------------------------
|
||||
resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_01" {
|
||||
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
|
||||
description = "Egress MySQL to sn-database"
|
||||
destination = var.cidr_subnet_database
|
||||
destination_type = "CIDR_BLOCK"
|
||||
direction = "EGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 3306
|
||||
min = 3306
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_02" {
|
||||
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
|
||||
description = "Egress MySQL Heatware to sn-database"
|
||||
destination = var.cidr_subnet_database
|
||||
destination_type = "CIDR_BLOCK"
|
||||
direction = "EGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 33060
|
||||
min = 33060
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_03" {
|
||||
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
|
||||
description = "Egress SOLR to sn-database"
|
||||
destination = var.cidr_subnet_app
|
||||
destination_type = "CIDR_BLOCK"
|
||||
direction = "EGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 8983
|
||||
min = 8983
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_04" {
|
||||
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
|
||||
description = "Egress Memcached to sn-app"
|
||||
destination = var.cidr_subnet_app
|
||||
destination_type = "CIDR_BLOCK"
|
||||
direction = "EGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 11211
|
||||
min = 11211
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_05" {
|
||||
network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
|
||||
description = "Egress Jod to sn-app"
|
||||
destination = var.cidr_subnet_app
|
||||
destination_type = "CIDR_BLOCK"
|
||||
direction = "EGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 8080
|
||||
min = 8080
|
||||
}
|
||||
}
|
||||
}
|
||||
#--------------------------------------------------------------------------------------------------------------------------------------------
|
||||
112
nsg-sip-servers-nsg.tf
Executable file
112
nsg-sip-servers-nsg.tf
Executable file
@@ -0,0 +1,112 @@
|
||||
resource "oci_core_network_security_group" "sip-servers-nsg" {
|
||||
compartment_id = var.ocid_compartment_networking
|
||||
display_name = "sip-servers-nsg"
|
||||
vcn_id = var.ocid_vcn_3_tier
|
||||
}
|
||||
#--------------------------------------------------------------------------------------------------------------------------------------------
|
||||
resource "oci_core_network_security_group_security_rule" "nsg_sip-server_ingress_rule_01" {
|
||||
network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
|
||||
description = "Ingress HTTP from Load Balancer."
|
||||
source = var.cidr_subnet_web
|
||||
source_type = "CIDR_BLOCK"
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 80
|
||||
min = 80
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "nsg_sip-server_ingress_rule_02" {
|
||||
network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
|
||||
description = "Ingress HTTPS from Load Balancer."
|
||||
source = var.cidr_subnet_web
|
||||
source_type = "CIDR_BLOCK"
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 443
|
||||
min = 443
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "nsg_sip-server_ingress_rule_03" {
|
||||
network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
|
||||
description = "Ingress SOLR from Load Balancer."
|
||||
source = var.cidr_subnet_web
|
||||
source_type = "CIDR_BLOCK"
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 8983
|
||||
min = 8983
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#--------------------------------------------------------------------------------------------------------------------------------------------
|
||||
resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_01" {
|
||||
network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
|
||||
description = "Egress MySQL to sn-database"
|
||||
destination = var.cidr_subnet_database
|
||||
destination_type = "CIDR_BLOCK"
|
||||
direction = "EGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 3306
|
||||
min = 3306
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_02" {
|
||||
network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
|
||||
description = "Egress MySQL Heatware to sn-database"
|
||||
destination = var.cidr_subnet_database
|
||||
destination_type = "CIDR_BLOCK"
|
||||
direction = "EGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 33060
|
||||
min = 33060
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_03" {
|
||||
network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
|
||||
description = "Egress SOLR to sn-database"
|
||||
destination = var.cidr_subnet_app
|
||||
destination_type = "CIDR_BLOCK"
|
||||
direction = "EGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 8983
|
||||
min = 8983
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_04" {
|
||||
network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
|
||||
description = "Egress Memcached to sn-app"
|
||||
destination = var.cidr_subnet_app
|
||||
destination_type = "CIDR_BLOCK"
|
||||
direction = "EGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 11211
|
||||
min = 11211
|
||||
}
|
||||
}
|
||||
}
|
||||
#--------------------------------------------------------------------------------------------------------------------------------------------
|
||||
51
nsg-solr-servers-nsg.tf
Executable file
51
nsg-solr-servers-nsg.tf
Executable file
@@ -0,0 +1,51 @@
|
||||
resource "oci_core_network_security_group" "solr-server-nsg" {
|
||||
compartment_id = var.ocid_compartment_networking
|
||||
display_name = "solr-servers-nsg"
|
||||
vcn_id = var.ocid_vcn_3_tier
|
||||
}
|
||||
#--------------------------------------------------------------------------------------------------------------------------------------------
|
||||
resource "oci_core_network_security_group_security_rule" "nsg_solr-server_ingress_rule_01" {
|
||||
network_security_group_id = oci_core_network_security_group.solr-server-nsg.id
|
||||
description = "Ingress SOLR from Load Balancer."
|
||||
source = var.cidr_subnet_web
|
||||
source_type = "CIDR_BLOCK"
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 8983
|
||||
min = 8983
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "nsg_solr-server_ingress_rule_02" {
|
||||
network_security_group_id = oci_core_network_security_group.solr-server-nsg.id
|
||||
description = "Ingress SOLR from Load Balancer."
|
||||
source = var.cidr_subnet_app
|
||||
source_type = "CIDR_BLOCK"
|
||||
direction = "INGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 8983
|
||||
min = 8983
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_core_network_security_group_security_rule" "nsg_solr_servers_security_egress_rule_03" {
|
||||
network_security_group_id = oci_core_network_security_group.solr-server-nsg.id
|
||||
description = "Egress Memcached to sn-app"
|
||||
destination = var.cidr_subnet_app
|
||||
destination_type = "CIDR_BLOCK"
|
||||
direction = "EGRESS"
|
||||
protocol = "6"
|
||||
tcp_options {
|
||||
destination_port_range {
|
||||
max = 11211
|
||||
min = 11211
|
||||
}
|
||||
}
|
||||
}
|
||||
#--------------------------------------------------------------------------------------------------------------------------------------------
|
||||
17
providers.tf
Executable file
17
providers.tf
Executable file
@@ -0,0 +1,17 @@
|
||||
# Copyright (c) 2023, 2025, Oracle and/or its affiliates.
|
||||
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
|
||||
provider "oci" {
|
||||
region = var.region
|
||||
tenancy_ocid = var.tenancy_ocid
|
||||
user_ocid = var.user_ocid
|
||||
fingerprint = var.fingerprint
|
||||
private_key_path = var.private_key_path
|
||||
}
|
||||
|
||||
terraform {
|
||||
required_providers {
|
||||
oci = {
|
||||
source = "oracle/oci"
|
||||
}
|
||||
}
|
||||
}
|
||||
258
sei_public_load_balancer.tf
Executable file
258
sei_public_load_balancer.tf
Executable file
@@ -0,0 +1,258 @@
|
||||
resource "oci_load_balancer_load_balancer" "sei_load_balancer_public" {
|
||||
compartment_id = var.ocid_compartment_networking
|
||||
display_name = "${var.load_balancer_prefix_hostname}-${var.environment}-public"
|
||||
shape = "flexible"
|
||||
subnet_ids = [ var.ocid_subnet_public ]
|
||||
is_delete_protection_enabled = "false"
|
||||
is_private = "false"
|
||||
network_security_group_ids = [ oci_core_network_security_group.load-balancer-public-nsg.id ]
|
||||
shape_details {
|
||||
maximum_bandwidth_in_mbps = var.load_balancer_maximum_bandwidth_in_mbps
|
||||
minimum_bandwidth_in_mbps = var.load_balancer_minimum_bandwidth_in_mbps
|
||||
}
|
||||
}
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
resource "oci_load_balancer_backend_set" "backend_set_sei_servers" {
|
||||
health_checker {
|
||||
protocol = "HTTP"
|
||||
interval_ms = "10000"
|
||||
port = "80"
|
||||
retries = "3"
|
||||
return_code = "302"
|
||||
timeout_in_millis = "3000"
|
||||
url_path = "/"
|
||||
}
|
||||
load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
name = "bs-sei-servers"
|
||||
policy = "IP_HASH"
|
||||
session_persistence_configuration {
|
||||
cookie_name = "PHPSESSID-SEI"
|
||||
}
|
||||
}
|
||||
#------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
resource "oci_load_balancer_backend_set" "backend_set_sip_servers" {
|
||||
health_checker {
|
||||
protocol = "HTTP"
|
||||
interval_ms = "10000"
|
||||
port = "80"
|
||||
retries = "3"
|
||||
return_code = "302"
|
||||
timeout_in_millis = "3000"
|
||||
url_path = "/"
|
||||
}
|
||||
load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
name = "bs-sip-servers"
|
||||
policy = "IP_HASH"
|
||||
session_persistence_configuration {
|
||||
cookie_name = "PHPSESSID-SIP"
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_load_balancer_backend_set" "backend_set_solr_servers" {
|
||||
health_checker {
|
||||
protocol = "HTTP"
|
||||
interval_ms = "10000"
|
||||
port = "8983"
|
||||
retries = "3"
|
||||
return_code = "302"
|
||||
timeout_in_millis = "3000"
|
||||
url_path = "/solr"
|
||||
}
|
||||
load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
name = "bs-solr-servers"
|
||||
policy = "IP_HASH"
|
||||
}
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
resource "oci_load_balancer_backend" "sip_servers" {
|
||||
for_each = { for idx, inst in oci_core_instance.sip-instance : idx => inst }
|
||||
backendset_name = oci_load_balancer_backend_set.backend_set_sip_servers.name
|
||||
ip_address = each.value.private_ip
|
||||
load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
port = "80"
|
||||
}
|
||||
|
||||
#------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
resource "oci_load_balancer_backend" "sei_servers" {
|
||||
for_each = { for idx, inst in oci_core_instance.sei-instance : idx => inst }
|
||||
backendset_name = oci_load_balancer_backend_set.backend_set_sei_servers.name
|
||||
ip_address = each.value.private_ip
|
||||
load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
port = "80"
|
||||
}
|
||||
#------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
resource "oci_load_balancer_backend" "solr_servers" {
|
||||
for_each = { for idx, inst in oci_core_instance.solr-instance : idx => inst }
|
||||
backendset_name = oci_load_balancer_backend_set.backend_set_solr_servers.name
|
||||
ip_address = each.value.private_ip
|
||||
load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
port = "8983"
|
||||
}
|
||||
#------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
resource "oci_load_balancer_listener" "lister_http_sei" {
|
||||
default_backend_set_name = oci_load_balancer_backend_set.backend_set_sei_servers.name
|
||||
load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
name = "listener-sei"
|
||||
port = "80"
|
||||
protocol = "HTTP"
|
||||
hostname_names = [ oci_load_balancer_hostname.sei_hostname.name ]
|
||||
}
|
||||
#------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
resource "oci_load_balancer_listener" "lister_http_sip" {
|
||||
default_backend_set_name = oci_load_balancer_backend_set.backend_set_sip_servers.name
|
||||
load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
name = "listener-sip"
|
||||
port = "80"
|
||||
protocol = "HTTP"
|
||||
hostname_names = [ oci_load_balancer_hostname.sip_hostname.name ]
|
||||
}
|
||||
#------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
resource "oci_load_balancer_listener" "lister_solr" {
|
||||
default_backend_set_name = oci_load_balancer_backend_set.backend_set_solr_servers.name
|
||||
load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
name = "listener-solr"
|
||||
port = "8983"
|
||||
protocol = "HTTP"
|
||||
hostname_names = [ oci_load_balancer_hostname.solr_hostname.name ]
|
||||
}
|
||||
#------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
# AQUI
|
||||
#------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
resource "oci_load_balancer_hostname" "sei_hostname" {
|
||||
hostname = var.sei_fqdn
|
||||
load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
name = "sei-fqdn"
|
||||
}
|
||||
|
||||
|
||||
resource "oci_load_balancer_hostname" "sip_hostname" {
|
||||
hostname = var.sip_fqdn
|
||||
load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
name = "sip-fqdn"
|
||||
}
|
||||
|
||||
resource "oci_load_balancer_hostname" "solr_hostname" {
|
||||
hostname = var.solr_fqdn
|
||||
load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
name = "solr-fqdn"
|
||||
}
|
||||
#------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
resource "oci_logging_log" "lb_access_log" {
|
||||
display_name = "${oci_load_balancer_load_balancer.sei_load_balancer_public.display_name}-access-log"
|
||||
log_group_id = oci_logging_log_group.sei_log_group.id
|
||||
log_type = "SERVICE"
|
||||
|
||||
configuration {
|
||||
source {
|
||||
source_type = "OCISERVICE"
|
||||
service = "loadbalancer"
|
||||
resource = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
category = "access"
|
||||
}
|
||||
|
||||
compartment_id = var.ocid_compartment_networking
|
||||
}
|
||||
|
||||
is_enabled = true
|
||||
retention_duration = 30
|
||||
}
|
||||
|
||||
resource "oci_logging_log" "lb_error_log" {
|
||||
display_name = "${oci_load_balancer_load_balancer.sei_load_balancer_public.display_name}-error-log"
|
||||
log_group_id = oci_logging_log_group.sei_log_group.id
|
||||
log_type = "SERVICE"
|
||||
|
||||
configuration {
|
||||
source {
|
||||
source_type = "OCISERVICE"
|
||||
service = "loadbalancer"
|
||||
resource = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
category = "error"
|
||||
}
|
||||
|
||||
compartment_id = var.ocid_compartment_networking
|
||||
}
|
||||
is_enabled = true
|
||||
retention_duration = 30
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
# resource "oci_load_balancer_listener" "lister_sei_https" {
|
||||
# default_backend_set_name = oci_load_balancer_backend_set.backend_set_sei_apps.name
|
||||
# load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
# name = "listener-sei-https"
|
||||
# port = "443"
|
||||
# protocol = "HTTP"
|
||||
# hostname_names = [ oci_load_balancer_hostname.sei_hostname.name ]
|
||||
# ssl_configuration {
|
||||
# certificate_ids = [ "ocid1.certificate.oc1.sa-saopaulo-1.amaaaaaaz63sg4iagucp6pedtfwbxd3oxud5ds7atsgsf2a6lwi6c5nnv7va" ]
|
||||
# protocols = [ "TLSv1.2", "TLSv1.3" ]
|
||||
# cipher_suite_name = "oci-default-ssl-cipher-suite-v1"
|
||||
# verify_peer_certificate = "false"
|
||||
# verify_depth = "1"
|
||||
# }
|
||||
# rule_set_names = [ oci_load_balancer_rule_set.redirectHttpToHttps.name ]
|
||||
# }
|
||||
#
|
||||
# resource "oci_load_balancer_listener" "lister_sip_https" {
|
||||
# default_backend_set_name = oci_load_balancer_backend_set.backend_set_sip_apps.name
|
||||
# load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
# name = "listener-sip-https"
|
||||
# port = "443"
|
||||
# protocol = "HTTP"
|
||||
# hostname_names = [ oci_load_balancer_hostname.sip_hostname.name ]
|
||||
# ssl_configuration {
|
||||
# certificate_ids = [ "ocid1.certificate.oc1.sa-saopaulo-1.amaaaaaaz63sg4iagucp6pedtfwbxd3oxud5ds7atsgsf2a6lwi6c5nnv7va" ]
|
||||
# protocols = [ "TLSv1.2", "TLSv1.3" ]
|
||||
# cipher_suite_name = "oci-default-ssl-cipher-suite-v1"
|
||||
# verify_peer_certificate = "false"
|
||||
# verify_depth = "1"
|
||||
# }
|
||||
# }
|
||||
##-----
|
||||
|
||||
#resource "oci_load_balancer_load_balancer_routing_policy" "sei_routing_policy" {
|
||||
# condition_language_version = "V1"
|
||||
# load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
# name = "RedirectHttpToHTTPs"
|
||||
# rules {
|
||||
# #Required
|
||||
# actions {
|
||||
# #Required
|
||||
# backend_set_name = oci_load_balancer_backend_set.backend_set_sei_apps.name
|
||||
# name = "FORWARD_TO_BACKENDSET"
|
||||
# }
|
||||
# condition = "any(http.request.url.path sw '/SIP')"
|
||||
# name = "SIP_SERVER"
|
||||
# }
|
||||
#}
|
||||
#
|
||||
#
|
||||
#resource "oci_load_balancer_rule_set" "redirectHttpToHttps" {
|
||||
# items {
|
||||
# action = "REDIRECT"
|
||||
# conditions {
|
||||
# #Required
|
||||
# attribute_name = "PATH"
|
||||
# attribute_value = "/"
|
||||
#
|
||||
# #Optional
|
||||
# operator = "FORCE_LONGEST_PREFIX_MATCH"
|
||||
# }
|
||||
# redirect_uri {
|
||||
# protocol = "HTTPS"
|
||||
# host = "{host}"
|
||||
# port = 443
|
||||
# path = "/{path}"
|
||||
# query = "?{query}"
|
||||
# }
|
||||
#
|
||||
# response_code = 302
|
||||
# }
|
||||
# load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
# name = "redirect_http_to_https"
|
||||
#}
|
||||
601
sei_waf.tf
Executable file
601
sei_waf.tf
Executable file
@@ -0,0 +1,601 @@
|
||||
resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
|
||||
count = var.var.enable_waf == "true" ? 1 : 0
|
||||
compartment_id = var.ocid_compartment_networking
|
||||
display_name = "sei-waf-policy-${var.environment}-v01"
|
||||
actions {
|
||||
code = 0
|
||||
name = "Pre-configured Check Action"
|
||||
type = "CHECK"
|
||||
}
|
||||
actions {
|
||||
code = 0
|
||||
name = "Pre-configured Allow Action"
|
||||
type = "ALLOW"
|
||||
}
|
||||
|
||||
actions {
|
||||
code = 401
|
||||
name = "Pre-configured 401 Response Code Action"
|
||||
type = "RETURN_HTTP_RESPONSE"
|
||||
body {
|
||||
text = jsonencode({
|
||||
code = "401"
|
||||
message = "Unauthorized"
|
||||
})
|
||||
type = "STATIC_TEXT"
|
||||
}
|
||||
headers {
|
||||
name = "Content-Type"
|
||||
value = "application/json"
|
||||
}
|
||||
}
|
||||
|
||||
actions {
|
||||
code = 403
|
||||
name = "Deny Country"
|
||||
type = "RETURN_HTTP_RESPONSE"
|
||||
body {
|
||||
text = jsonencode({
|
||||
code = "403"
|
||||
message = "This is country is Forbidden request"
|
||||
})
|
||||
type = "STATIC_TEXT"
|
||||
}
|
||||
headers {
|
||||
name = "Content-Type"
|
||||
value = "application/json"
|
||||
}
|
||||
}
|
||||
request_access_control {
|
||||
default_action_name = "Pre-configured Allow Action"
|
||||
rules {
|
||||
action_name = "Deny Country"
|
||||
condition = "!i_contains(['BR'], connection.source.geo.countryCode)"
|
||||
condition_language = "JMESPATH"
|
||||
name = "Allow Countries"
|
||||
type = "ACCESS_CONTROL"
|
||||
}
|
||||
}
|
||||
request_protection {
|
||||
body_inspection_size_limit_in_bytes = 8192
|
||||
rules {
|
||||
action_name = "Pre-configured Check Action"
|
||||
condition_language = "JMESPATH"
|
||||
is_body_inspection_enabled = true
|
||||
name = "recommended-protection-rules"
|
||||
type = "PROTECTION"
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "942270"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "9420000"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "941140"
|
||||
version = 3
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "9410000"
|
||||
version = 3
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "9330000"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "9320001"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "9320000"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "930120"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "9300000"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "920390"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "920380"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "920370"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "920320"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "920300"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "920280"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "911100"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "200003"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "200002"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "200001"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "200000"
|
||||
version = 1
|
||||
}
|
||||
}
|
||||
rules {
|
||||
action_name = "Pre-configured Check Action"
|
||||
condition_language = "JMESPATH"
|
||||
is_body_inspection_enabled = true
|
||||
name = "mysql-protection-rules"
|
||||
type = "PROTECTION"
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "942500"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "942362"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "942360"
|
||||
version = 3
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "942350"
|
||||
version = 3
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "942320"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "942300"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "942270"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "9420000"
|
||||
version = 2
|
||||
}
|
||||
}
|
||||
rules {
|
||||
action_name = "Pre-configured Check Action"
|
||||
condition_language = "JMESPATH"
|
||||
is_body_inspection_enabled = true
|
||||
name = "php-protection-rules"
|
||||
type = "PROTECTION"
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "933210"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "933200"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "933190"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "933180"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "933170"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "933161"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "933160"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "933151"
|
||||
version = 3
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "933150"
|
||||
version = 3
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "933140"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "933131"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "933130"
|
||||
version = 3
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "933120"
|
||||
version = 3
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "933111"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "933110"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "933100"
|
||||
version = 3
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "9330000"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202157426"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202153567"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202153566"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "921200"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "20224794"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "20224230"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202221661"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202156905"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202156524"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202156523"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202155838"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202155836"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202155797"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202155778"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202154596"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202142670"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202142669"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202132305"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "201950711"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "201950709"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "201950708"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "201949647"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "201949646"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "201949645"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "201947768"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "201947767"
|
||||
version = 1
|
||||
}
|
||||
}
|
||||
rules {
|
||||
action_name = "Pre-configured Check Action"
|
||||
condition_language = "JMESPATH"
|
||||
is_body_inspection_enabled = true
|
||||
name = "apache-protection-rules"
|
||||
type = "PROTECTION"
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "944260"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "944152"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "944151"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "944150"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "944130"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "944110, 944120"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "944100"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "933161"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "933160"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "932160"
|
||||
version = 3
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "932131"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "932130"
|
||||
version = 3
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "932105"
|
||||
version = 3
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202258447"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202224112"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202223944"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202157921"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202156990"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202156989"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202154649"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202144228"
|
||||
version = 2
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202142013"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "202129592"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "201947649"
|
||||
version = 1
|
||||
}
|
||||
protection_capabilities {
|
||||
collaborative_action_threshold = 0
|
||||
key = "2017100"
|
||||
version = 1
|
||||
}
|
||||
}
|
||||
}
|
||||
request_rate_limiting {
|
||||
}
|
||||
response_access_control {
|
||||
}
|
||||
}
|
||||
|
||||
resource "oci_waf_web_app_firewall" "sei_public_load_balancer_waf" {
|
||||
count = var.enable_waf ? 1 : 0
|
||||
backend_type = "LOAD_BALANCER"
|
||||
compartment_id = var.ocid_compartment_security
|
||||
load_balancer_id = oci_load_balancer_load_balancer.sei_load_balancer_public.id
|
||||
web_app_firewall_policy_id = oci_waf_web_app_firewall_policy.sei-waf-policy[count.index].id
|
||||
display_name = oci_load_balancer_load_balancer.sei_load_balancer_public.display_name
|
||||
}
|
||||
|
||||
resource "oci_logging_log" "waf_log_lb_public" {
|
||||
count = var.enable_waf ? 1 : 0
|
||||
display_name = "${oci_load_balancer_load_balancer.sei_load_balancer_public.display_name}-waf-log"
|
||||
log_group_id = oci_logging_log_group.sei_log_group.id
|
||||
log_type = "SERVICE"
|
||||
configuration {
|
||||
source {
|
||||
category = "all"
|
||||
resource = oci_waf_web_app_firewall.sei_public_load_balancer_waf[count.index].id
|
||||
service = "waf"
|
||||
source_type = "OCISERVICE"
|
||||
}
|
||||
compartment_id = var.ocid_compartment_security
|
||||
}
|
||||
is_enabled = "true"
|
||||
retention_duration = "30"
|
||||
}
|
||||
35
server_instances_jod.tf
Executable file
35
server_instances_jod.tf
Executable file
@@ -0,0 +1,35 @@
|
||||
resource "oci_core_instance" "jod-instance" {
|
||||
count = var.jod_amount_instances
|
||||
availability_domain = data.oci_identity_availability_domain.ad.name
|
||||
fault_domain = data.oci_identity_fault_domains.fds.fault_domains[count.index % length(data.oci_identity_fault_domains.fds.fault_domains)].name
|
||||
compartment_id = var.ocid_compartment_app
|
||||
display_name = "${var.jod_prefix_hostname}-${var.environment}-0${count.index + 1}"
|
||||
shape = var.jod_shape
|
||||
shape_config {
|
||||
ocpus = var.jod_amount_ocpus
|
||||
memory_in_gbs = var.jod_amount_memory
|
||||
}
|
||||
|
||||
create_vnic_details {
|
||||
subnet_id = var.ocid_subnet_app
|
||||
assign_public_ip = false
|
||||
}
|
||||
|
||||
source_details {
|
||||
source_type = "image"
|
||||
source_id = data.oci_core_images.ol9_latest.images[0].id
|
||||
}
|
||||
|
||||
metadata = {
|
||||
ssh_authorized_keys = tls_private_key.master_ssh_key.public_key_openssh
|
||||
user_data = "${base64encode(file("utils/cloud-init-jod.yaml"))}"
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
source_details [ "source_id" ],
|
||||
#metadata [ "user_data" ]
|
||||
]
|
||||
}
|
||||
|
||||
}
|
||||
35
server_instances_memcached.tf
Executable file
35
server_instances_memcached.tf
Executable file
@@ -0,0 +1,35 @@
|
||||
resource "oci_core_instance" "memcached-instance" {
|
||||
count = var.memcached_amount_instances
|
||||
availability_domain = data.oci_identity_availability_domain.ad.name
|
||||
fault_domain = data.oci_identity_fault_domains.fds.fault_domains[count.index % length(data.oci_identity_fault_domains.fds.fault_domains)].name
|
||||
compartment_id = var.ocid_compartment_app
|
||||
display_name = "${var.memcached_prefix_hostname}-${var.environment}-0${count.index + 1}"
|
||||
shape = var.memcached_shape
|
||||
shape_config {
|
||||
ocpus = var.memcached_amount_ocpus
|
||||
memory_in_gbs = var.memcached_amount_memory
|
||||
}
|
||||
|
||||
create_vnic_details {
|
||||
subnet_id = var.ocid_subnet_app
|
||||
assign_public_ip = false
|
||||
nsg_ids = [ oci_core_network_security_group.memcached-servers-nsg.id ]
|
||||
}
|
||||
|
||||
source_details {
|
||||
source_type = "image"
|
||||
source_id = data.oci_core_images.ol9_latest.images[0].id
|
||||
}
|
||||
|
||||
metadata = {
|
||||
ssh_authorized_keys = tls_private_key.master_ssh_key.public_key_openssh
|
||||
user_data = "${base64encode(file("utils/cloud-init-memcached.yaml"))}"
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
source_details [ "source_id" ],
|
||||
#metadata [ "user_data" ]
|
||||
]
|
||||
}
|
||||
}
|
||||
35
server_instances_sei.tf
Executable file
35
server_instances_sei.tf
Executable file
@@ -0,0 +1,35 @@
|
||||
resource "oci_core_instance" "sei-instance" {
|
||||
count = var.sei_amount_instances
|
||||
availability_domain = data.oci_identity_availability_domain.ad.name
|
||||
fault_domain = data.oci_identity_fault_domains.fds.fault_domains[count.index % length(data.oci_identity_fault_domains.fds.fault_domains)].name
|
||||
compartment_id = var.ocid_compartment_app
|
||||
display_name = "${var.sei_prefix_hostname}-${var.environment}-0${count.index + 1}"
|
||||
shape = var.sei_shape
|
||||
shape_config {
|
||||
ocpus = var.sei_amount_ocpus
|
||||
memory_in_gbs = var.sei_amount_memory
|
||||
}
|
||||
|
||||
create_vnic_details {
|
||||
subnet_id = var.ocid_subnet_app
|
||||
assign_public_ip = false
|
||||
nsg_ids = [ oci_core_network_security_group.sei-public-nsg.id]
|
||||
}
|
||||
|
||||
source_details {
|
||||
source_type = "image"
|
||||
source_id = data.oci_core_images.ol9_latest.images[0].id
|
||||
}
|
||||
|
||||
metadata = {
|
||||
ssh_authorized_keys = tls_private_key.master_ssh_key.public_key_openssh
|
||||
user_data = "${base64encode(file("utils/cloud-init-sei.yaml"))}"
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
source_details [ "source_id" ],
|
||||
#metadata [ "user_data" ]
|
||||
]
|
||||
}
|
||||
}
|
||||
36
server_instances_sip.tf
Executable file
36
server_instances_sip.tf
Executable file
@@ -0,0 +1,36 @@
|
||||
resource "oci_core_instance" "sip-instance" {
|
||||
count = var.sip_amount_instances
|
||||
availability_domain = data.oci_identity_availability_domain.ad.name
|
||||
fault_domain = data.oci_identity_fault_domains.fds.fault_domains[count.index % length(data.oci_identity_fault_domains.fds.fault_domains)].name
|
||||
compartment_id = var.ocid_compartment_app
|
||||
display_name = "${var.sip_prefix_hostname}-${var.environment}-0${count.index + 1}"
|
||||
shape = var.sip_shape
|
||||
shape_config {
|
||||
ocpus = var.sip_amount_ocpus
|
||||
memory_in_gbs = var.sip_amount_memory
|
||||
}
|
||||
|
||||
create_vnic_details {
|
||||
subnet_id = var.ocid_subnet_app
|
||||
assign_public_ip = false
|
||||
nsg_ids = [ oci_core_network_security_group.sip-servers-nsg.id ]
|
||||
}
|
||||
|
||||
source_details {
|
||||
source_type = "image"
|
||||
source_id = data.oci_core_images.ol9_latest.images[0].id
|
||||
}
|
||||
|
||||
metadata = {
|
||||
ssh_authorized_keys = tls_private_key.master_ssh_key.public_key_openssh
|
||||
user_data = "${base64encode(file("utils/cloud-init-sip.yaml"))}"
|
||||
}
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
source_details [ "source_id" ],
|
||||
#metadata [ "user_data" ]
|
||||
]
|
||||
}
|
||||
|
||||
}
|
||||
35
server_instances_solr.tf
Executable file
35
server_instances_solr.tf
Executable file
@@ -0,0 +1,35 @@
|
||||
resource "oci_core_instance" "solr-instance" {
|
||||
count = var.solr_amount_instances
|
||||
availability_domain = data.oci_identity_availability_domain.ad.name
|
||||
fault_domain = data.oci_identity_fault_domains.fds.fault_domains[count.index % length(data.oci_identity_fault_domains.fds.fault_domains)].name
|
||||
compartment_id = var.ocid_compartment_app
|
||||
display_name = "${var.solr_prefix_hostname}-${var.environment}-0${count.index + 1}"
|
||||
shape = var.solr_shape
|
||||
shape_config {
|
||||
ocpus = var.solr_amount_ocpus
|
||||
memory_in_gbs = var.solr_amount_memory
|
||||
}
|
||||
|
||||
create_vnic_details {
|
||||
subnet_id = var.ocid_subnet_app
|
||||
assign_public_ip = false
|
||||
nsg_ids = [ oci_core_network_security_group.solr-servers-nsg.id ]
|
||||
}
|
||||
|
||||
source_details {
|
||||
source_type = "image"
|
||||
source_id = data.oci_core_images.ol9_latest.images[0].id
|
||||
boot_volume_size_in_gbs = var.solr_boot_disk_size
|
||||
}
|
||||
|
||||
metadata = {
|
||||
ssh_authorized_keys = tls_private_key.master_ssh_key.public_key_openssh
|
||||
user_data = "${base64encode(file("utils/cloud-init-solr.yaml"))}" }
|
||||
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
source_details [ "source_id" ],
|
||||
#metadata [ "user_data" ]
|
||||
]
|
||||
}
|
||||
}
|
||||
84
terraform.tfvars
Normal file
84
terraform.tfvars
Normal file
@@ -0,0 +1,84 @@
|
||||
#================================================================================================================================================================================================
|
||||
# Parameters to authenticate with Oracle Cloud Infrastructure
|
||||
tenancy_ocid = ""
|
||||
user_ocid = ""
|
||||
fingerprint = ""
|
||||
private_key_path = "/home/opc/.oci/terraform_key.pem"
|
||||
region = "sa-saopaulo-1"
|
||||
|
||||
#================================================================================================================================================================================================
|
||||
# The environment that you're creating resources for: test, dev, prod, or staging
|
||||
environment="hml"
|
||||
#================================================================================================================================================================================================
|
||||
# The environment compartments
|
||||
ocid_compartment_app = ""
|
||||
ocid_compartment_database = ""
|
||||
ocid_compartment_security = ""
|
||||
ocid_compartment_networking = ""
|
||||
#================================================================================================================================================================================================
|
||||
# The environment networks
|
||||
ocid_vcn_3_tier = ""
|
||||
ocid_subnet_app = ""
|
||||
ocid_subnet_database = ""
|
||||
ocid_subnet_public = ""
|
||||
#================================================================================================================================================================================================
|
||||
# The CIDR networks
|
||||
cidr_subnet_app = "172.20.2.64/26"
|
||||
cidr_subnet_database = "172.20.2.128/26"
|
||||
cidr_subnet_web = "172.20.2.0/26"
|
||||
cidr_anywhere = "0.0.0.0/0"
|
||||
#================================================================================================================================================================================================
|
||||
# SEI Variables
|
||||
sei_amount_instances = "1"
|
||||
sei_prefix_hostname = "sei-server"
|
||||
sei_shape = "VM.Standard.E4.Flex"
|
||||
sei_amount_memory = "4"
|
||||
sei_amount_ocpus = "1"
|
||||
sei_fqdn = ""
|
||||
#================================================================================================================================================================================================
|
||||
# SIP Variables
|
||||
sip_amount_instances = "1"
|
||||
sip_prefix_hostname = "sip-server"
|
||||
sip_shape = "VM.Standard.E4.Flex"
|
||||
sip_amount_memory = "4"
|
||||
sip_amount_ocpus = "1"
|
||||
sip_fqdn = ""
|
||||
#================================================================================================================================================================================================
|
||||
# SOLR Variables
|
||||
solr_amount_instances = "2"
|
||||
solr_prefix_hostname = "solr-server"
|
||||
solr_shape = "VM.Standard.E4.Flex"
|
||||
solr_amount_memory = "8"
|
||||
solr_amount_ocpus = "1"
|
||||
solr_boot_disk_size = "200"
|
||||
solr_fqdn = ""
|
||||
#================================================================================================================================================================================================
|
||||
# Memcached Variables
|
||||
memcached_amount_instances = "1"
|
||||
memcached_prefix_hostname = "memcached-server"
|
||||
memcached_shape = "VM.Standard.E4.Flex"
|
||||
memcached_amount_memory = "2"
|
||||
memcached_amount_ocpus = "1"
|
||||
#================================================================================================================================================================================================
|
||||
# JodServer Variables
|
||||
jod_amount_instances = "1"
|
||||
jod_prefix_hostname = "jod-server"
|
||||
jod_shape = "VM.Standard.E4.Flex"
|
||||
jod_amount_memory = "2"
|
||||
jod_amount_ocpus = "1"
|
||||
#================================================================================================================================================================================================
|
||||
# Public Load Balancer Variables
|
||||
load_balancer_prefix_hostname= "sei-load-balancer"
|
||||
load_balancer_maximum_bandwidth_in_mbps = "100"
|
||||
load_balancer_minimum_bandwidth_in_mbps = "10"
|
||||
#================================================================================================================================================================================================
|
||||
# FSS Variables
|
||||
fss_backup = false
|
||||
sei_nfs_name = "nfs-sei"
|
||||
#================================================================================================================================================================================================
|
||||
# WAF Variables
|
||||
enable_waf = false
|
||||
#================================================================================================================================================================================================
|
||||
# Boot Volume Backup Variables
|
||||
enable_boot_volume_backup = false
|
||||
#================================================================================================================================================================================================
|
||||
34
utils/cloud-init-jod.yaml
Normal file
34
utils/cloud-init-jod.yaml
Normal file
@@ -0,0 +1,34 @@
|
||||
#cloud-config
|
||||
|
||||
yum_repos:
|
||||
epel:
|
||||
name: Extra Packages for Enterprise Linux
|
||||
baseurl: https://yum$ociregion.$ocidomain/repo/OracleLinux/OL9/developer/EPEL/$basearch/
|
||||
enabled: true
|
||||
gpgcheck: true
|
||||
|
||||
timezone: America/Sao_Paulo
|
||||
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
packages:
|
||||
- vim
|
||||
- wget
|
||||
- libreoffice
|
||||
- java-1.8.0-openjdk
|
||||
- google-noto-fonts-common.noarch
|
||||
- fontawesome-fonts.noarch
|
||||
- google-noto-sans-cjk-ttc-fonts.noarch
|
||||
|
||||
runcmd:
|
||||
- [systemctl, disable, firewalld.service, --now]
|
||||
- [ sed, -i, 's/^SELINUX.*/SELINUX=disabled/', /etc/selinux/config]
|
||||
- [setenforce, 0]
|
||||
- [localectl, set-locale, LANG=pt_BR.ISO-8859-1]
|
||||
- [nmcli, conn, modify, "System enp0s5", ipv6.method, disabled]
|
||||
- [nmcli, conn, modify, "Wired Connection", ipv6.method, disabled]
|
||||
- [nmcli, conn, up, "Wired Connection"]
|
||||
- [systemctl, restart, NetworkManager]
|
||||
|
||||
final_message: "Jod Instance ready after $UPTIME seconds"
|
||||
35
utils/cloud-init-memcached.yaml
Normal file
35
utils/cloud-init-memcached.yaml
Normal file
@@ -0,0 +1,35 @@
|
||||
#cloud-config
|
||||
|
||||
yum_repos:
|
||||
epel:
|
||||
name: Extra Packages for Enterprise Linux
|
||||
baseurl: https://yum$ociregion.$ocidomain/repo/OracleLinux/OL9/developer/EPEL/$basearch/
|
||||
enabled: true
|
||||
gpgcheck: true
|
||||
|
||||
timezone: America/Sao_Paulo
|
||||
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
packages:
|
||||
- gcc
|
||||
- curl-devel
|
||||
- java-1.8.0-openjdk
|
||||
- php-opcache.x86_64
|
||||
- glibc-langpack-pt
|
||||
- langpacks-pt
|
||||
- memcached
|
||||
|
||||
runcmd:
|
||||
- [systemctl, disable, firewalld.service, --now]
|
||||
- [setenforce, 0]
|
||||
- [sed, -i, 's/^SELINUX.*/SELINUX=disabled/', /etc/selinux/config]
|
||||
- [localectl, set-locale, LANG=pt_BR.ISO-8859-1]
|
||||
- [nmcli, conn, modify, "System enp0s5", ipv6.method, disabled]
|
||||
- [nmcli, conn, modify, "Wired Connection", ipv6.method, disabled]
|
||||
- [nmcli, conn, up, "Wired Connection"]
|
||||
- [systemctl, restart, NetworkManager]
|
||||
- [systemctl, enable, memcached.service, --now]
|
||||
|
||||
final_message: "MemCache Instance ready after $UPTIME seconds"
|
||||
99
utils/cloud-init-sei.yaml
Normal file
99
utils/cloud-init-sei.yaml
Normal file
@@ -0,0 +1,99 @@
|
||||
#cloud-config
|
||||
|
||||
yum_repos:
|
||||
epel:
|
||||
name: Extra Packages for Enterprise Linux
|
||||
baseurl: https://yum$ociregion.$ocidomain/repo/OracleLinux/OL9/developer/EPEL/$basearch/
|
||||
enabled: true
|
||||
gpgcheck: true
|
||||
|
||||
timezone: America/Sao_Paulo
|
||||
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
write_files:
|
||||
- path: /tmp/robots.txt
|
||||
owner: 'root:root'
|
||||
permissions: '0644'
|
||||
defer: true
|
||||
content: |
|
||||
User-agent: *
|
||||
Disallow: /
|
||||
|
||||
- path: /tmp/sei.conf
|
||||
owner: 'root:root'
|
||||
permissions: '0644'
|
||||
defer: true
|
||||
content: |
|
||||
Alias "/infra_css" "/opt/infra/infra_css"
|
||||
Alias "/infra_js" "/opt/infra/infra_js"
|
||||
<Directory />
|
||||
AllowOverride None
|
||||
Require all denied
|
||||
</Directory>
|
||||
<Directory ~ "(/opt/sei/web|/opt/infra/infra_css|/opt/infra/infra_js)">
|
||||
AllowOverride None
|
||||
Options None
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
runcmd:
|
||||
- sudo systemctl disable firewalld.service --now
|
||||
- sudo setenforce 0
|
||||
- sudo dnf install httpd mod_ssl @php:8.2 php-bcmath.x86_64 php-gd.x86_64 php-soap.x86_64 php-pecl-zip.x86_64 php-pear gcc curl-devel php-devel zlib-devel pcre-devel php-intl.x86_64 java-1.8.0-openjdk php-opcache.x86_64 glibc-langpack-pt langpacks-pt php-mysqlnd.x86_64 -y
|
||||
- sudo pecl install igbinary memcache uploadprogress
|
||||
- echo "extension=memcache" | sudo tee -a /etc/php.d/20-memcache.ini
|
||||
- echo "extension=igbinary" | sudo tee -a /etc/php.d/20-igbinary.ini
|
||||
- echo "extension=uploadprogress" | sudo tee -a /etc/php.d/20-uploadprogress.ini
|
||||
- sudo sed -i '124c\DocumentRoot "/opt/sei/web"' /etc/httpd/conf/httpd.conf
|
||||
- sudo sed -i '136c\<Directory "/opt/sei/web">' /etc/httpd/conf/httpd.conf
|
||||
- sudo dnf install -y https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6.1-3/wkhtmltox-0.12.6.1-3.almalinux9.x86_64.rpm
|
||||
- sudo ln -sf /usr/local/bin/wkhtmltopdf /usr/bin/
|
||||
- sudo localectl set-locale LANG=pt_BR.ISO-8859-1
|
||||
- sudo sed -i '1342c\session.gc_maxlifetime = 28800' /etc/php.ini
|
||||
- sudo sed -i '198c\short_open_tag = On' /etc/php.ini
|
||||
- sudo sed -i '426c\max_input_vars = 1000' /etc/php.ini
|
||||
- sudo sed -i '561c\html_errors = off' /etc/php.ini
|
||||
- sudo sed -i '703c\post_max_size = 201M' /etc/php.ini
|
||||
- sudo sed -i '855c\upload_max_filesize = 200M' /etc/php.ini
|
||||
- sudo sed -i '1276c\session.cookie_secure = 1' /etc/php.ini
|
||||
- sudo sed -i '722c\default_charset = "ISO-8859-1"' /etc/php.ini
|
||||
- sudo sed -i '47c\Listen 0.0.0.0:80' /etc/httpd/conf/httpd.conf
|
||||
- sudo sed -i '115c\pm.max_children = 92' /etc/php-fpm.d/www.conf
|
||||
- sudo sed -i '120c\pm.start_servers = 8' /etc/php-fpm.d/www.conf
|
||||
- sudo sed -i '125c\pm.min_spare_servers = 4' /etc/php-fpm.d/www.conf
|
||||
- sudo sed -i '130c\pm.max_spare_servers = 35' /etc/php-fpm.d/www.conf
|
||||
- sudo sed -i '141c\pm.max_requests = 500' /etc/php-fpm.d/www.conf
|
||||
- sudo sed -i '745c\include_path = "/opt/infra/infra_php"' /etc/php.ini
|
||||
- sudo sed -i '22c\SELINUX=disabled' /etc/selinux/config
|
||||
- sudo sed -i "11c\opcache.opcache.memory_consumption=256" /etc/php.d/10-opcache.ini
|
||||
- sudo sed -i "14c\opcache.opcache.interned_strings_buffer=16" /etc/php.d/10-opcache.ini
|
||||
- sudo sed -i "18c\opcache.opcache.max_accelerated_files=50000" /etc/php.d/10-opcache.ini
|
||||
- sudo sed -i "31c\opcache.validate_timestamps=0" /etc/php.d/10-opcache.ini
|
||||
- sudo sed -i "36c\opcache.revalidate_freq=0" /etc/php.d/10-opcache.ini
|
||||
- mkdir -p /sei-nfs/dados
|
||||
- mkdir -p /run/php-fpm
|
||||
- echo "opcache.jit = 1254" | sudo tee -a /etc/php.d/10-opcache.ini
|
||||
- echo "opcache.jit_buffer_size = 256M" | sudo tee -a /etc/php.d/10-opcache.ini
|
||||
- sudo echo -e "#Desabilitar output buffer e alterar timeout\n<Proxy fcgi://localhost>\n ProxySet enablereuse=off flushpackets=auto timeout=610 keepalive=on\n</Proxy>\n#forcar envio de Content-Length quando não informado\nSetEnv proxy-sendcl 1" >> /etc/httpd/conf/httpd.conf
|
||||
- sudo mkdir -p /opt/infra/infra_php
|
||||
- sudo mkdir -p /opt/sei/web
|
||||
- sudo mkdir -p /sei-nfs/dados
|
||||
- sudo cp /tmp/robots.txt /opt/sei/robots.txt
|
||||
- sudo cp /tmp/sei.conf /etc/httpd/conf.d/sei.conf
|
||||
- sudo chown -R root:apache /opt/infra
|
||||
- sudo chown -R root:apache /opt/sei
|
||||
- sudo chown -R root:apache /var/www
|
||||
- sudo openssl req -x509 -nodes -newkey rsa:4096 -keyout /etc/pki/tls/private/localhost.key -out /etc/pki/tls/certs/localhost.crt -days 3650 -subj '/CN=localhost'
|
||||
- sudo rm -f /etc/httpd/conf.d/{userdir.conf,welcome.conf}
|
||||
- sudo systemctl enable php-fpm.service --now
|
||||
- sudo systemctl enable httpd.service --now
|
||||
- sudo systemctl restart php-fpm.service
|
||||
- sudo systemctl restart httpd.service
|
||||
- sudo nmcli conn modify enp0s5 ipv6.method disabled
|
||||
- sudo systemctl restart NetworkManager
|
||||
- echo "00 01 * * * root rm -rf /opt/sei/temp/*" | sudo crontab
|
||||
- sudo systemctl reload crond.service
|
||||
|
||||
final_message: "SEI Instance ready after $UPTIME seconds"
|
||||
95
utils/cloud-init-sip.yaml
Normal file
95
utils/cloud-init-sip.yaml
Normal file
@@ -0,0 +1,95 @@
|
||||
#cloud-config
|
||||
|
||||
yum_repos:
|
||||
epel:
|
||||
name: Extra Packages for Enterprise Linux
|
||||
baseurl: https://yum$ociregion.$ocidomain/repo/OracleLinux/OL9/developer/EPEL/$basearch/
|
||||
enabled: true
|
||||
gpgcheck: true
|
||||
|
||||
timezone: America/Sao_Paulo
|
||||
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
write_files:
|
||||
- path: /tmp/robots.txt
|
||||
owner: 'root:root'
|
||||
permissions: '0644'
|
||||
defer: true
|
||||
content: |
|
||||
User-agent: *
|
||||
Disallow: /
|
||||
|
||||
- path: /tmp/sip.conf
|
||||
owner: 'root:root'
|
||||
permissions: '0644'
|
||||
defer: true
|
||||
content: |
|
||||
Alias "/infra_css" "/opt/infra/infra_css"
|
||||
Alias "/infra_js" "/opt/infra/infra_js"
|
||||
<Directory />
|
||||
AllowOverride None
|
||||
Require all denied
|
||||
</Directory>
|
||||
<Directory ~ "(/opt/sip/web|/opt/infra/infra_css|/opt/infra/infra_js)" >
|
||||
AllowOverride None
|
||||
Options None
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
runcmd:
|
||||
- sudo systemctl disable firewalld.service --now
|
||||
- sudo setenforce 0
|
||||
- sudo dnf install httpd mod_ssl @php:8.2 php-bcmath.x86_64 php-gd.x86_64 php-soap.x86_64 php-pecl-zip.x86_64 php-pear gcc curl-devel php-devel zlib-devel pcre-devel php-intl.x86_64 java-1.8.0-openjdk php-opcache.x86_64 glibc-langpack-pt langpacks-pt php-mysqlnd.x86_64 -y
|
||||
- sudo pecl install igbinary memcache uploadprogress
|
||||
- echo "extension=memcache" | sudo tee -a /etc/php.d/20-memcache.ini
|
||||
- echo "extension=igbinary" | sudo tee -a /etc/php.d/20-igbinary.ini
|
||||
- echo "extension=uploadprogress" | sudo tee -a /etc/php.d/20-uploadprogress.ini
|
||||
- sudo sed -i '124c\DocumentRoot "/opt/sip/web"' /etc/httpd/conf/httpd.conf
|
||||
- sudo sed -i '136c\<Directory "/opt/sip/web">' /etc/httpd/conf/httpd.conf
|
||||
- sudo dnf install -y https://github.com/wkhtmltopdf/packaging/releases/download/0.12.6.1-3/wkhtmltox-0.12.6.1-3.almalinux9.x86_64.rpm
|
||||
- sudo ln -sf /usr/local/bin/wkhtmltopdf /usr/bin/
|
||||
- sudo localectl set-locale LANG=pt_BR.ISO-8859-1
|
||||
- sudo sed -i '1342c\session.gc_maxlifetime = 28800' /etc/php.ini
|
||||
- sudo sed -i '198c\short_open_tag = On' /etc/php.ini
|
||||
- sudo sed -i '426c\max_input_vars = 1000' /etc/php.ini
|
||||
- sudo sed -i '561c\html_errors = off' /etc/php.ini
|
||||
- sudo sed -i '703c\post_max_size = 201M' /etc/php.ini
|
||||
- sudo sed -i '855c\upload_max_filesize = 200M' /etc/php.ini
|
||||
- sudo sed -i '1276c\session.cookie_secure = 1' /etc/php.ini
|
||||
- sudo sed -i '722c\default_charset = "ISO-8859-1"' /etc/php.ini
|
||||
- sudo sed -i '47c\Listen 0.0.0.0:80' /etc/httpd/conf/httpd.conf
|
||||
- sudo sed -i '115c\pm.max_children = 92' /etc/php-fpm.d/www.conf
|
||||
- sudo sed -i '120c\pm.start_servers = 8' /etc/php-fpm.d/www.conf
|
||||
- sudo sed -i '125c\pm.min_spare_servers = 4' /etc/php-fpm.d/www.conf
|
||||
- sudo sed -i '130c\pm.max_spare_servers = 35' /etc/php-fpm.d/www.conf
|
||||
- sudo sed -i '141c\pm.max_requests = 500' /etc/php-fpm.d/www.conf
|
||||
- sudo sed -i '745c\include_path = "/opt/infra/infra_php"' /etc/php.ini
|
||||
- sudo sed -i '22c\SELINUX=disabled' /etc/selinux/config
|
||||
- echo "opcache.jit = 1254" | sudo tee -a /etc/php.d/10-opcache.ini
|
||||
- echo "opcache.jit_buffer_size = 256M" | sudo tee -a /etc/php.d/10-opcache.ini
|
||||
- sudo echo -e "#Desabilitar output buffer e alterar timeout\n<Proxy fcgi://localhost>\n ProxySet enablereuse=off flushpackets=auto timeout=610 keepalive=on\n</Proxy>\n#forcar envio de Content-Length quando não informado\nSetEnv proxy-sendcl 1" >> /etc/httpd/conf/httpd.conf
|
||||
- sudo mkdir -p /opt/infra
|
||||
- sudo mkdir -p /opt/sip
|
||||
- sudo chown -R root:apache /opt/infra
|
||||
- sudo chown -R root:apache /opt/sip
|
||||
- sudo chown -R root:apache /var/www
|
||||
- sudo chown -R apache:apache /run/php-fpm
|
||||
- sudo cp /tmp/robots.txt /opt/sip/robots.txt
|
||||
- sudo cp /tmp/sei.conf /etc/httpd/conf.d/sip.conf
|
||||
- sudo rm -f /etc/httpd/conf.d/{userdir.conf,welcome.conf}
|
||||
- sudo systemctl enable php-fpm.service --now
|
||||
- sudo systemctl enable httpd.service --now
|
||||
- sudo systemctl restart httpd.service
|
||||
- sudo systemctl restart php-fpm.service
|
||||
- echo "00 01 * * * root rm -rf /opt/sip/temp/*" | sudo crontab
|
||||
- sudo systemctl reload crond.service
|
||||
- sudo nmcli conn modify enp0s5 ipv6.method disabled
|
||||
- sudo nmcli conn modify "System enp0s5" ipv6.method disabled
|
||||
- sudo nmcli conn modify "Wired Connection" ipv6.method disabled
|
||||
- sudo nmcli conn up "Wired Connection"
|
||||
- sudo systemctl restart NetworkManager
|
||||
|
||||
final_message: "SIP Instance ready after $UPTIME seconds"
|
||||
|
||||
51
utils/cloud-init-solr.yaml
Normal file
51
utils/cloud-init-solr.yaml
Normal file
@@ -0,0 +1,51 @@
|
||||
#cloud-config
|
||||
|
||||
yum_repos:
|
||||
epel:
|
||||
name: Extra Packages for Enterprise Linux
|
||||
baseurl: https://yum$ociregion.$ocidomain/repo/OracleLinux/OL9/developer/EPEL/$basearch/
|
||||
enabled: true
|
||||
gpgcheck: true
|
||||
|
||||
timezone: America/Sao_Paulo
|
||||
|
||||
package_update: true
|
||||
package_upgrade: true
|
||||
|
||||
packages:
|
||||
- lsof
|
||||
- java-17-openjdk
|
||||
- java-17-openjdk-devel
|
||||
|
||||
runcmd:
|
||||
- [systemctl, disable, firewalld.service, --now]
|
||||
- [setenforce, 0]
|
||||
- [sysctl, -p]
|
||||
- [mkdir, /dados]
|
||||
- [localectl, set-locale, LANG=pt_BR.UTF-8]
|
||||
- [wget, https://objectstorage.sa-saopaulo-1.oraclecloud.com/p/sCbg0kkAI_DOehFCLxUFg_LN9ypX0vXddkxj7A__uxtCrD1AkBUZnH-8ixMgCPCI/n/gr2g2eizhkzs/b/bucket-sei/o/solr-9.6.1.tgz, -O, /tmp/solr-9.6.1.tgz]
|
||||
- [tar, -xvf, /tmp/solr-9.6.1.tgz, -C, /tmp/]
|
||||
- [/tmp/solr-9.6.1/bin/install_solr_service.sh, /tmp/solr-9.6.1.tgz]
|
||||
- [sed, -i, 's/^SELINUX.*/SELINUX=disabled/', /etc/selinux/config]
|
||||
- [/usr/libexec/oci-growfs, -y]
|
||||
- IP=$(ip -o -4 addr show | awk '{print $4}' | cut -d/ -f1 | sed -n '2p') && sed -i "s|^#SOLR_HOST.*|SOLR_HOST=${IP}|" /etc/default/solr.in.sh
|
||||
- [sed, -i, 's/^#SOLR_JAVA_MEM.*/SOLR_JAVA_MEM="-Xms512m -Xmx28g"/', /etc/default/solr.in.sh]
|
||||
- [sed, -i, 's/^#SOLR_JETTY_HOST.*/SOLR_JETTY_HOST="0.0.0.0"/', /etc/default/solr.in.sh]
|
||||
- [sed, -i, 's/^#SOLR_REQUESTLOG_ENABLED.*/SOLR_REQUESTLOG_ENABLED=false/', /etc/default/solr.in.sh]
|
||||
- [sed, -i, 's|^#SOLR_OPTS.*|SOLR_OPTS="$SOLR_OPTS -Dsolr.allowPaths=/dados|-Djava.net.preferIPv4Stack=true"|', /etc/default/solr.in.sh]
|
||||
- [service, solr, stop]
|
||||
- [systemctl, enable, --now, solr.service]
|
||||
- [systemctl, start, solr.service]
|
||||
- [nmcli, conn, modify, "System enp0s5", ipv6.method, disabled]
|
||||
- [nmcli, conn, modify, "Wired Connection", ipv6.method, disabled]
|
||||
- [nmcli, conn, up, "Wired Connection"]
|
||||
- [systemctl, restart, NetworkManager]
|
||||
- [/usr/libexec/oci-growfs, -y]
|
||||
|
||||
final_message: "SOLR Instance ready after $UPTIME seconds"
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
81
variables.tf
Normal file
81
variables.tf
Normal file
@@ -0,0 +1,81 @@
|
||||
variable "tenancy_ocid" {}
|
||||
variable "user_ocid" {}
|
||||
variable "fingerprint" {}
|
||||
variable "private_key_path" {}
|
||||
variable "region" {}
|
||||
variable "environment" {
|
||||
type = string
|
||||
}
|
||||
|
||||
# Comparments
|
||||
variable "ocid_compartment_app" {}
|
||||
variable "ocid_compartment_database" {}
|
||||
variable "ocid_compartment_security" {}
|
||||
variable "ocid_compartment_networking" {}
|
||||
|
||||
# The environment networks
|
||||
variable "ocid_vcn_3_tier" {}
|
||||
variable "ocid_subnet_app" {}
|
||||
variable "ocid_subnet_database" {}
|
||||
variable "ocid_subnet_public" {}
|
||||
|
||||
# SEI Variables
|
||||
variable "sei_amount_instances" {}
|
||||
variable "sei_prefix_hostname" {}
|
||||
variable "sei_shape" {}
|
||||
variable "sei_amount_memory" {}
|
||||
variable "sei_amount_ocpus" {}
|
||||
variable "sei_fqdn" {}
|
||||
|
||||
|
||||
# SIP Variables
|
||||
variable "sip_amount_instances" {}
|
||||
variable "sip_prefix_hostname" {}
|
||||
variable "sip_shape" {}
|
||||
variable "sip_amount_memory" {}
|
||||
variable "sip_amount_ocpus" {}
|
||||
variable "sip_fqdn" {}
|
||||
|
||||
# SOLR Variables
|
||||
variable "solr_amount_instances" {}
|
||||
variable "solr_prefix_hostname" {}
|
||||
variable "solr_shape" {}
|
||||
variable "solr_amount_memory" {}
|
||||
variable "solr_amount_ocpus" {}
|
||||
variable "solr_boot_disk_size" {}
|
||||
variable "solr_fqdn" {}
|
||||
|
||||
# Memcached Variables
|
||||
variable "memcached_amount_instances" {}
|
||||
variable "memcached_prefix_hostname" {}
|
||||
variable "memcached_shape" {}
|
||||
variable "memcached_amount_memory" {}
|
||||
variable "memcached_amount_ocpus" {}
|
||||
|
||||
# JodServer Variables
|
||||
variable "jod_amount_instances" {}
|
||||
variable "jod_prefix_hostname" {}
|
||||
variable "jod_shape" {}
|
||||
variable "jod_amount_memory" {}
|
||||
variable "jod_amount_ocpus" {}
|
||||
|
||||
# Public Load Balancer Variables
|
||||
variable "load_balancer_prefix_hostname" {}
|
||||
variable "load_balancer_maximum_bandwidth_in_mbps" {}
|
||||
variable "load_balancer_minimum_bandwidth_in_mbps" {}
|
||||
|
||||
# FSS
|
||||
variable "fss_backup" {}
|
||||
variable "sei_nfs_name" {}
|
||||
|
||||
# WAF
|
||||
variable "enable_waf" {}
|
||||
|
||||
# Backup Boot Volumes
|
||||
variable "enable_boot_volume_backup" {}
|
||||
|
||||
# The CIDR networks
|
||||
variable "cidr_subnet_app" {}
|
||||
variable "cidr_subnet_database" {}
|
||||
variable "cidr_subnet_web" {}
|
||||
variable "cidr_anywhere" {}
|
||||
15
variables_sei_nfs.tf
Normal file
15
variables_sei_nfs.tf
Normal file
@@ -0,0 +1,15 @@
|
||||
# Copyright (c) 2023, 2025, Oracle and/or its affiliates.
|
||||
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
|
||||
|
||||
# ------------------------------------------------------
|
||||
variable "sei_nfs_name" {
|
||||
type = string
|
||||
default = "nfs-sei"
|
||||
description = "Nome do FSS para o SEI"
|
||||
}
|
||||
|
||||
variable "sei_mount_target_ip_address" {
|
||||
type = string
|
||||
default = "10.191.228.100"
|
||||
description = "IP Address para o mount target"
|
||||
}
|
||||
15
vault.tf
Normal file
15
vault.tf
Normal file
@@ -0,0 +1,15 @@
|
||||
resource "oci_kms_vault" "vault-sei" {
|
||||
compartment_id = var.ocid_compartment_security
|
||||
display_name = "sei-vault-${var.environment}"
|
||||
vault_type = "DEFAULT"
|
||||
}
|
||||
|
||||
resource "oci_kms_key" "sei-vault-keys" {
|
||||
compartment_id = var.ocid_compartment_security
|
||||
display_name = "sei-vault-${var.environment}"
|
||||
management_endpoint = oci_kms_vault.vault-sei.management_endpoint
|
||||
key_shape {
|
||||
algorithm = "AES"
|
||||
length = "32"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user