Merge pull request 'sei-fixeds' (#1) from sei-fixeds into main

Reviewed-on: #1

.gitignore

@@ -0,0 +1,47 @@
+# Local .terraform directories
+.terraform/
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data, such as
+# password, private keys, and other secrets. These should not be part of version
+# control as they are data points which are potentially sensitive and subject
+# to change depending on the environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Ignore transient lock info files created by terraform apply
+.terraform.tfstate.lock.info
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+
+# Optional: ignore graph output files generated by `terraform graph`
+# *.dot
+
+# Optional: ignore plan files saved before destroying Terraform configuration
+# Uncomment the line below if you want to ignore planout files.
+# planout
+
+.terraform.lock.hcl
+*.DS_Store

README.md

@@ -207,3 +207,17 @@ Ponto de atencao: embora os secrets sejam armazenados no OCI Vault, valores gera
 | Memcached servers | Ingress | `cidr_subnet_app` | 11211 | Trafego Memcached. |
 | JodServer | Ingress | `cidr_subnet_app` | 8080 | Trafego JodServer. |
 | Database | Ingress | `cidr_subnet_app` | 3306, 33060 | Trafego MySQL/MySQL HeatWave. |
+
+## Instalação SEI
+
+### Criação de usuários no MySQL
+
+```
+CREATE USER 'sei_user'@'%' IDENTIFIED BY 'SuaSenhaSegura';
+CREATE USER 'sip_user'@'%' IDENTIFIED BY 'SuaSenhaSegura';
+
+GRANT ALL PRIVILEGES ON sei.* TO 'sei_user'@'%';
+GRANT ALL PRIVILEGES ON sip.* TO 'sip_user'@'%';
+
+FLUSH PRIVILEGES;
+```

data_sources.tf

@@ -30,3 +30,5 @@ data "oci_mysql_mysql_configurations" "sei_mysql_configurations" {
   shape_name   = "MySQL.4"
   type         = ["DEFAULT"]
 }
+
+data "oci_core_services" "all_services" {}

nsg-database-nsg.tf

@@ -35,3 +35,17 @@ resource "oci_core_network_security_group_security_rule" "nsg_db_security_ingres
   }
 }
 #--------------------------------------------------------------------------------------------------------------------------------------------
+resource "oci_core_network_security_group_security_rule" "nsg_db_security_egress_rule_01" {
+  network_security_group_id = oci_core_network_security_group.db-server-nsg.id
+  description =  "Egress to OSN"
+  destination =  lookup(data.oci_core_services.all_services.services[1], "cidr_block")
+  destination_type =  "SERVICE_CIDR_BLOCK"
+  direction =  "EGRESS"
+  protocol =  "6"
+  tcp_options  {
+    destination_port_range  {
+      max =  443
+      min =  443
+    }
+  }
+}

nsg-jod-servers-nsg.tf

@@ -20,3 +20,32 @@ resource "oci_core_network_security_group_security_rule" "jod_servers_security_i
 }
 
 #--------------------------------------------------------------------------------------------------------------------------------------------
+resource "oci_core_network_security_group_security_rule" "jod_servers_security_egress_rule_01" {
+  network_security_group_id = oci_core_network_security_group.jod-servers-nsg.id
+  description =  "Egress to OSN"
+  destination =  lookup(data.oci_core_services.all_services.services[1], "cidr_block")
+  destination_type =  "SERVICE_CIDR_BLOCK"
+  direction =  "EGRESS"
+  protocol =  "6"
+  tcp_options  {
+    destination_port_range  {
+      max =  443
+      min =  443
+    }
+  }
+}
+
+resource "oci_core_network_security_group_security_rule" "jod_servers_security_egress_rule_02" {
+  network_security_group_id = oci_core_network_security_group.jod-servers-nsg.id
+  description =  "Egress to Internet only port TCP/443"
+  destination =  var.cidr_anywhere
+  destination_type =  "CIDR_BLOCK"
+  direction =  "EGRESS"
+  protocol =  "6"
+  tcp_options  {
+    destination_port_range  {
+      max =  443
+      min =  443
+    }
+  }
+}

nsg-memcached-servers-nsg.tf

@@ -21,3 +21,32 @@ resource "oci_core_network_security_group_security_rule" "nsg_memcached_ingress_
 
 
 #--------------------------------------------------------------------------------------------------------------------------------------------
+resource "oci_core_network_security_group_security_rule" "nsg_memcached_egress_rule_01" {
+  network_security_group_id = oci_core_network_security_group.memcached-servers-nsg.id
+  description =  "Egress to OSN"
+  destination =  lookup(data.oci_core_services.all_services.services[1], "cidr_block")
+  destination_type =  "SERVICE_CIDR_BLOCK"
+  direction =  "EGRESS"
+  protocol =  "6"
+  tcp_options  {
+    destination_port_range  {
+      max =  443
+      min =  443
+    }
+  }
+}
+
+resource "oci_core_network_security_group_security_rule" "nsg_memcached_egress_rule_02" {
+  network_security_group_id = oci_core_network_security_group.memcached-servers-nsg.id
+  description =  "Egress to Internet port TCP/443"
+  destination =  var.cidr_anywhere
+  destination_type =  "CIDR_BLOCK"
+  direction =  "EGRESS"
+  protocol =  "6"
+  tcp_options  {
+    destination_port_range  {
+      max =  443
+      min =  443
+    }
+  }
+}

nsg-sei-servers-nsg.tf

@@ -51,6 +51,51 @@ resource "oci_core_network_security_group_security_rule" "sei_servers_security_i
 
 #--------------------------------------------------------------------------------------------------------------------------------------------
 resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_01" {
+  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
+  description =  "Egress to Internet port TCP/80"
+  destination =  var.cidr_anywhere
+  destination_type =  "CIDR_BLOCK"
+  direction =  "EGRESS"
+  protocol =  "6"
+  tcp_options  {
+    destination_port_range  {
+      max =  80
+      min =  80
+    }
+  }
+}
+
+resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_02" {
+  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
+  description =  "Egress to OSN port TCP/443"
+  destination =  lookup(data.oci_core_services.all_services.services[1], "cidr_block")
+  destination_type =  "SERVICE_CIDR_BLOCK"
+  direction =  "EGRESS"
+  protocol =  "6"
+  tcp_options  {
+    destination_port_range  {
+      max =  443
+      min =  443
+    }
+  }
+}
+
+resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_03" {
+  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
+  description =  "Egress to Internet port TCP/443"
+  destination =  var.cidr_anywhere
+  destination_type =  "CIDR_BLOCK"
+  direction =  "EGRESS"
+  protocol =  "6"
+  tcp_options  {
+    destination_port_range  {
+      max =  443
+      min =  443
+    }
+  }
+}
+
+resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_04" {
   network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
   description =  "Egress MySQL to sn-database"
   destination =  var.cidr_subnet_database
@@ -65,51 +110,6 @@ resource "oci_core_network_security_group_security_rule" "sei_servers_security_e
   }
 }
 
-resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_02" {
-  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
-  description =  "Egress MySQL Heatware to sn-database"
-  destination =  var.cidr_subnet_database
-  destination_type =  "CIDR_BLOCK"
-  direction =  "EGRESS"
-  protocol =  "6"
-  tcp_options  {
-    destination_port_range  {
-      max =  33060
-      min =  33060
-    }
-  }
-}
-
-resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_03" {
-  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
-  description =  "Egress SOLR to sn-database"
-  destination =  var.cidr_subnet_app
-  destination_type =  "CIDR_BLOCK"
-  direction =  "EGRESS"
-  protocol =  "6"
-  tcp_options  {
-    destination_port_range  {
-      max =  8983
-      min =  8983
-    }
-  }
-}
-
-resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_04" {
-  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
-  description =  "Egress Memcached to sn-app"
-  destination =  var.cidr_subnet_app
-  destination_type =  "CIDR_BLOCK"
-  direction =  "EGRESS"
-  protocol =  "6"
-  tcp_options  {
-    destination_port_range  {
-      max =  11211
-      min =  11211
-    }
-  }
-}
-
 resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_05" {
   network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
   description =  "Egress Jod to sn-app"
@@ -124,4 +124,49 @@ resource "oci_core_network_security_group_security_rule" "sei_servers_security_e
     }
   }
 }
+
+resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_06" {
+  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
+  description =  "Egress SOLR to sn-database"
+  destination =  var.cidr_subnet_app
+  destination_type =  "CIDR_BLOCK"
+  direction =  "EGRESS"
+  protocol =  "6"
+  tcp_options  {
+    destination_port_range  {
+      max =  8983
+      min =  8983
+    }
+  }
+}
+
+resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_07" {
+  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
+  description =  "Egress Memcached to sn-app"
+  destination =  var.cidr_subnet_app
+  destination_type =  "CIDR_BLOCK"
+  direction =  "EGRESS"
+  protocol =  "6"
+  tcp_options  {
+    destination_port_range  {
+      max =  11211
+      min =  11211
+    }
+  }
+}
+
+resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_08" {
+  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
+  description =  "Egress MySQL Heatware to sn-database"
+  destination =  var.cidr_subnet_database
+  destination_type =  "CIDR_BLOCK"
+  direction =  "EGRESS"
+  protocol =  "6"
+  tcp_options  {
+    destination_port_range  {
+      max =  33060
+      min =  33060
+    }
+  }
+}
 #--------------------------------------------------------------------------------------------------------------------------------------------

nsg-sip-servers-nsg.tf

@@ -51,6 +51,51 @@ resource "oci_core_network_security_group_security_rule" "nsg_sip-server_ingress
 
 #--------------------------------------------------------------------------------------------------------------------------------------------
 resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_01" {
+  network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
+  description =  "Egress to Internet port TCP/80"
+  destination =  var.cidr_anywhere
+  destination_type =  "CIDR_BLOCK"
+  direction =  "EGRESS"
+  protocol =  "6"
+  tcp_options  {
+    destination_port_range  {
+      max =  80
+      min =  80
+    }
+  }
+}
+
+resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_02" {
+  network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
+  description =  "Egress to OSN"
+  destination =  lookup(data.oci_core_services.all_services.services[1], "cidr_block")
+  destination_type =  "SERVICE_CIDR_BLOCK"
+  direction =  "EGRESS"
+  protocol =  "6"
+  tcp_options  {
+    destination_port_range  {
+      max =  443
+      min =  443
+    }
+  }
+}
+
+resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_03" {
+  network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
+  description =  "Egress to Internet port TCP/443"
+  destination =  var.cidr_anywhere
+  destination_type =  "CIDR_BLOCK"
+  direction =  "EGRESS"
+  protocol =  "6"
+  tcp_options  {
+    destination_port_range  {
+      max =  443
+      min =  443
+    }
+  }
+}
+
+resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_04" {
   network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
   description =  "Egress MySQL to sn-database"
   destination =  var.cidr_subnet_database
@@ -65,22 +110,7 @@ resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_
   }
 }
 
-resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_02" {
+resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_05" {
-  network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
-  description =  "Egress MySQL Heatware to sn-database"
-  destination =  var.cidr_subnet_database
-  destination_type =  "CIDR_BLOCK"
-  direction =  "EGRESS"
-  protocol =  "6"
-  tcp_options  {
-    destination_port_range  {
-      max =  33060
-      min =  33060
-    }
-  }
-}
-
-resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_03" {
   network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
   description =  "Egress SOLR to sn-database"
   destination =  var.cidr_subnet_app
@@ -95,7 +125,7 @@ resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_
   }
 }
 
-resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_04" {
+resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_06" {
   network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
   description =  "Egress Memcached to sn-app"
   destination =  var.cidr_subnet_app
@@ -109,4 +139,21 @@ resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_
     }
   }
 }
+
+resource "oci_core_network_security_group_security_rule" "nsg_sip-server_egress_rule_07" {
+  network_security_group_id = oci_core_network_security_group.sip-servers-nsg.id
+  description =  "Egress MySQL Heatware to sn-database"
+  destination =  var.cidr_subnet_database
+  destination_type =  "CIDR_BLOCK"
+  direction =  "EGRESS"
+  protocol =  "6"
+  tcp_options  {
+    destination_port_range  {
+      max =  33060
+      min =  33060
+    }
+  }
+}
+
+
 #--------------------------------------------------------------------------------------------------------------------------------------------

nsg-solr-servers-nsg.tf

@@ -33,6 +33,36 @@ resource "oci_core_network_security_group_security_rule" "nsg_solr-server_ingres
     }
   }
 }
+#--------------------------------------------------------------------------------------------------------------------------------------------
+resource "oci_core_network_security_group_security_rule" "nsg_solr_servers_security_egress_rule_01" {
+  network_security_group_id = oci_core_network_security_group.solr-server-nsg.id
+  description =  "Egress to OSN"
+  destination =  lookup(data.oci_core_services.all_services.services[1], "cidr_block")
+  destination_type =  "SERVICE_CIDR_BLOCK"
+  direction =  "EGRESS"
+  protocol =  "6"
+  tcp_options  {
+    destination_port_range  {
+      max =  443
+      min =  443
+    }
+  }
+}
+
+resource "oci_core_network_security_group_security_rule" "nsg_solr_servers_security_egress_rule_02" {
+  network_security_group_id = oci_core_network_security_group.solr-server-nsg.id
+  description =  "Egress to Internet only port TCP/443"
+  destination =  var.cidr_anywhere
+  destination_type =  "CIDR_BLOCK"
+  direction =  "EGRESS"
+  protocol =  "6"
+  tcp_options  {
+    destination_port_range  {
+      max =  443
+      min =  443
+    }
+  }
+}
 
 resource "oci_core_network_security_group_security_rule" "nsg_solr_servers_security_egress_rule_03" {
   network_security_group_id = oci_core_network_security_group.solr-server-nsg.id

sei_waf.tf

@@ -1,5 +1,5 @@
 resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
-  count = var.var.enable_waf == "true" ? 1 : 0
+  count = var.enable_waf == "true" ? 1 : 0
   compartment_id = var.ocid_compartment_networking
   display_name  = "sei-waf-policy-${var.environment}-v01"
   actions {

server_instances_memcached.tf

@@ -28,8 +28,7 @@ resource "oci_core_instance" "memcached-instance" {
 
   lifecycle {
     ignore_changes = [
-      source_details [ "source_id" ],
+      source_details [ "source_id" ]
-      #metadata [ "user_data" ] 
     ]
   }
 }

server_instances_sei.tf

@@ -13,7 +13,7 @@ resource "oci_core_instance" "sei-instance" {
   create_vnic_details {
     subnet_id         = var.ocid_subnet_app
     assign_public_ip  = false
-    nsg_ids         = [ oci_core_network_security_group.sei-public-nsg.id]
+    nsg_ids         = [ oci_core_network_security_group.sei-servers-nsg.id ]
   }
 
   source_details {
@@ -28,8 +28,7 @@ resource "oci_core_instance" "sei-instance" {
   
   lifecycle {
     ignore_changes = [
-      source_details [ "source_id" ],
+      source_details [ "source_id" ]
-      #metadata [ "user_data" ]
     ]
   }
 }

server_instances_sip.tf

@@ -28,8 +28,7 @@ resource "oci_core_instance" "sip-instance" {
   
   lifecycle {
     ignore_changes = [
-      source_details [ "source_id" ],
+      source_details [ "source_id" ]
-      #metadata [ "user_data" ]
     ]
   }
 

server_instances_solr.tf

@@ -13,7 +13,7 @@ resource "oci_core_instance" "solr-instance" {
   create_vnic_details {
     subnet_id              = var.ocid_subnet_app
     assign_public_ip       = false
-    nsg_ids                = [ oci_core_network_security_group.solr-servers-nsg.id ]
+    nsg_ids                = [ oci_core_network_security_group.solr-server-nsg.id ]
   }
 
   source_details {
@@ -28,8 +28,7 @@ resource "oci_core_instance" "solr-instance" {
 
   lifecycle {
     ignore_changes = [
-      source_details [ "source_id" ],
+      source_details [ "source_id" ]
-      #metadata [ "user_data" ] 
     ]
   }
 }

variables_sei_nfs.tf

@@ -1,15 +0,0 @@
-# Copyright (c) 2023, 2025, Oracle and/or its affiliates.
-# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
-
-# ------------------------------------------------------
-variable "sei_nfs_name" {
-  type        = string
-  default     = "nfs-sei"
-  description = "Nome do FSS para o SEI"
-}
-
-variable "sei_mount_target_ip_address" {
-  type        = string
-  default     = "10.191.228.100"
-  description = "IP Address para o mount target"
-}